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ABSTRACT 


This  research  will  focus  on  fusion  centers,  particularly  the  expectation  of  state  and 
local  fusion  centers  and  their  role.  How  will  fusion  centers  add  to  the  national  effort  to 
protect  the  Homeland,  while  also  providing  a  benefit  to  their  local  communities?  This 
effort  will  seek  to  determine  what  role  the  state  and  local  fusion  centers  should  be 
concerned  with  and  how  they  might  add  local  value. 

With  the  increasing  prevalence  of  fusion  centers  it  will  be  important  to  determine 
how  those  fusion  centers  will  be  used  and  how  they  will  collect  the  information  that  they 
will  fuse,  or  analyze,  and  turn  into  an  intelligence  product.  There  are  several  questions 
before  fusion  centers  such  as,  who  are  your  customers,  what  is  your  product,  how  do  you 
collect  and  analyze  your  data,  how  do  you  get  information  from  emergency  responders 
and  actionable  intelligence  back  to  them? 

If  the  fusion  centers  can  produce  a  timely,  locally  actionable,  and  relevant  product 
to  its  customers  in  the  form  of  strategic  analysis  to  policy  makers,  tactical  analysis  to 
counter  terrorism,  tactical  analysis  to  major  criminal  investigations,  and  situational 
awareness  and  reporting  mechanisms  to  the  emergency  responder  community  then  they 
will  have  established  their  value. 
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I.  INTRODUCTION 


A.  PROBLEM  STATEMENT 

State  and  local  fusion  centers  have  emerged  in  a  rather  rapid  manner  throughout 
the  country.  This  is  a  natural  reaction  to  the  unexpected  attack  of  9/1 1.  Local  officials 
wanted  more  intelligence  to  prepare  them  to  protect  their  communities  against  any  such 
unimagined  attack  in  their  jurisdiction.  Many  officials  also  felt  they  were  not  being 
provided  sufficient  information  from  the  federal  intelligence  community  to  protect  their 
communities1  and  that  some  infonnation  was  being  withheld  (it  has  not  been 
demonstrated  that  this  information  actually  exists).2  However,  with  the  recent  influx  of 
fusion  centers  has  come  a  wide  range  of  applications  and  expectations,  and  more  than  a 
little  dissatisfaction,  with  the  outcome  of  the  fusion  center  efforts. 

This  thesis  will  not  measure  the  effectiveness  of  the  fusion  centers,  but  will 
attempt  to  identify  what  local  value  they  can  provide  to  state  and  local  jurisdictions  and 
how  that  value  may  be  increased.  As  the  centers  are  relatively  new,  there  are  very  few 
performance  measures  or  metrics  upon  which  to  measure  them.  This  thesis  will  simply 
accept  the  fact  that  they  exist  and  that  a  significant  amount  of  resources  in  time,  money 
and  personnel  have  been  expended  to  stand  them  up.  The  intent  of  this  thesis  is  to 
examine  how  the  fusion  centers  operate  and  to  try  to  identify  whether  there  are  some 
practices  that  could  optimize  their  value  at  the  state  and  local  level,  which  will  perhaps 
enhance  their  future  value. 

This  research  will  focus  on  fusion  centers,  particularly  the  expectation  of  state  and 
local  fusion  centers  and  their  role.  How  will  fusion  centers  add  to  the  national  effort  to 

1  Normal  Beasley,  Testimony  before  the  U.S.  Maricopa  County  (Arizona)  Sheriff  s  Office  Before  the 
U.S.  House  of  Representatives  House  Committee  on  Homeland  Security  Subcommittee  on  Intelligence, 
Information  Sharing  and  Terrorism  Risk  Assessment:  “The  Way  Forward  with  Fusion  Centers:  Challenges 
and  Strategies  for  Change,”  September  27,  2007,  6.,  https://www.hsdl.org/homesec/docs/testimony/nps33- 
092707-04. pdf&code=7035620d98ed78e74bl36023c2dd3clb.  last  accessed  November  12,  2007. 

2  Todd  Masse,  Siobhan  O'Neill,  and  John  Rollins,  CRS  report  for  Congress,  Fusion  Centers:  issues 
and  options  for  Congress,  July  6,  2007,  order  code  RL  34070,  28.  The  report  states  numerous  officials 
complained  about  not  getting  the  “right”  information  the  report  footnotes  identify  this  is  a  possible 
perception  issue  on  the  limits  of  national  intelligence. 
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protect  the  homeland  and  at  the  same  time  provide  a  benefit  to  their  local  communities? 
Is  replicating  the  federal  model  the  best  course  of  action  for  state  and  local  fusion  centers, 
or  is  there  an  alternative?  This  effort  will  seek  to  detennine  what  role  the  state  and  local 
fusion  centers  should  be  concerned  with,  and  how  they  might  add  local  value  to  the 
process. 

With  the  ever-increasing  prevalence  of  fusion  centers,  it  will  be  important  to 
determine  how  those  fusion  centers  will  be  used  and  how  they  will  collect  the 
information  that  they  will  fuse,  or  analyze,  and  turn  into  an  intelligence  product.  There 
are  several  questions  before  fusion  centers  such  as:  Who  are  your  customers,  what  is  your 
product,  and  how  do  you  collect  and  analyze  your  data?  Another  central  issue  before  the 
fusion  centers  is  how  they  get  infonnation  from  emergency  responders  and  actionable 
intelligence  back  to  them.  There  are  many  references  to  utilizing  emergency  responders 
as  intelligence  gatherers.  What  is  missing,  however,  are  direct  citations  or  models  as  to 
how  these  emergency  responders  are  utilized  to  collect  information  and  relay  that 
information  to  the  fusion  center. 

There  are  also  frequent  references  to  community-oriented  policing  and,  to  a  lesser 
extent,  to  Terrorism  Liaison  Officers  (TLO).  Again,  the  proponents  are  conspicuously 
vague  as  to  how  to  enact  or  implement  a  program  that  will  successfully  engage 
emergency  responders.  Nor  are  there  any  widely  distributed  reported  successes  by 
community-oriented  policing  efforts  in  interdicting  foreign  or  domestic  terrorism. 
Admittedly,  some  successes  may  go  unreported  or  undiscovered. 

A  further  problem  with  the  regional  fusion  centers  and  infonnation  collection  is 
that  there  is,  more  often  than  not,  insufficient  purely  “terrorist”  activity  to  support  a 
multi-jurisdictional  and  multi-governmental  level  fusion  center  that  exclusively  processes 
tenorist  activity.  If  a  fusion  center  (outside  of  perhaps  NY,  LA  or  DC)  were  to  rely 
solely  on  terrorist  data  to  process,  I  would  argue  the  analysts’  skills  would  atrophy,  as 
would  their  interest,  from  a  lack  of  relevant  work.  Additionally,  due  to  the  paucity  of 
strictly  terrorist  infonnation,  the  emergency  responder  community  would  soon  forget  the 
how  or  why  of  reporting  information  to  the  fusion  center,  regardless  of  any  marketing  or 
promotional  campaigns  to  gamer  interest  and  participation.  Fusion  centers  must  consider 
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analyzing  or  processing  other  criminal  activity,  in  addition  to  terrorist  activity,  in  order  to 
maintain  the  skills  and  interest  of  the  analysts,  as  well  as  the  participation  and  data 
collection  of  the  emergency  responder  community. 

The  Sacramento  Regional  Terrorism  Threat  Assessment  Center  (RTTAC)  has 
responsibility  for  thirty-four  counties  in  California  and  has  trained  hundreds  of  TLO 
officers  in  its  TLO  program.  At  the  time  this  project  was  started,  early  2007,  the  RTTAC 
had  received  very  limited  information,  leads,  or  tips  from  the  TLO  officers,  and  even  less 
from  the  emergency  responder  community  as  a  whole  (one  year  later,  the  tips  and  leads 
have  increased,  due  to  an  aggressive  TLO  campaign,  but  are  still  far  short  of  what  is 
hoped  for).3  That  lack  of  anticipated  response  begs  the  question  of  “why?”  Are  other 
agencies  having  the  same  lack  of  response?  It  is  my  suspicion  that  many  fusion  centers 
have  the  same  problem  as  Sacramento  in  collecting  infonnation  from  not  only  the  law 
enforcement  rank  and  file,  but  from  the  other  emergency  responder  disciplines  as  well. 

B.  RESEARCH  QUESTION 

Fusion  centers  are  getting  a  lot  of  attention  right  now,  and  deservedly  so,  as  a  step 
in  the  right  direction  for  information  and  intelligence  integration  between  federal,  state, 
and  local  agencies.  However,  they  may  be  missing  out  on  an  opportunity  to  capitalize  on 
a  largely  untapped  data  source  by  failing  to  aggressively  engage  emergency  and  front-line 
responders  to  collect  and  forward  potentially  helpful  information.  Information  that  would 
be  particularly  useful  in  detecting  and  deterring  domestically  generated  terrorist  plots. 

The  research  questions  I  will  be  asking  are: 

1)  What  is  the  mission  of  the  state  and  local  fusion  centers?  Do  they  have  a  national 

value?  Do  they  have  a  local  value? 

2)  What  can  be  done  to  improve  the  effectiveness  of  state  and  local  fusion  centers? 

My  research  will  address  the  following  issues  as  well: 


3  Lt.  Tim  Johnstone,  Sacramento  County  Sheriff  s  Department,  RTTAC  Commander,  personal 
communication,  2007. 
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1)  How  do  we  enhance  our  local  data  collection  capabilities?  Are  we  effectively 
getting  intelligence/information  from  the  emergency  responders  to  the  fusion  centers? 

2)  Is  it  beneficial  for  the  maximum  effectiveness  of  fusion  centers  to  have  a  conduit 
from  regional  front-line  responders  to  the  center  itself?  If  so,  how  can  we  streamline  the 
process  to  get  usable  information  to  the  front-line  responders,  actionable  intelligence  to 
the  law  enforcement  operations  and  how  do  we  get  the  infonnation  from  the  front-line 
responders  to  the  fusion  center? 

C.  SPECIFIC  RESEARCH  OBJECTIVE 

The  specific  research  objective  is  to  identify  effective  methods  for  fusion  centers 
to  operate  so  as  to  provide  value  to  the  national  effort  to  protect  the  homeland  and  the 
local  effort  to  protect  their  citizens;  and,  to  determine  how  or  if  the  use  of  locally 
collected  infonnation  produced  by  or  facilitated  by  emergency  responders  will  materially 
assist  in  that  effort. 

D.  SIGNIFICANCE  OF  RESEARCH 

•  Literature:  the  significance  of  this  research  will  prove  the  viability  of 
fusion  centers  by  utilizing  local  information  collection  methods  and 
producing  localized,  timely  and  relevant  intelligence.  Little  has  been 
written  in  this  area  and  this  thesis  will  add  to  the  existing  body  of  work. 

•  Future  research  efforts:  future  research  efforts  would  include 
conoboration  of  thesis’  findings  and  extensions  of  these  concepts  into 
other  communities  and  professions.  Future  research  efforts  to  measure  the 
effectiveness  of  fusions  centers  should  be  done  once  they  have  had 
sufficient  time  to  mature  and  perfonnance  metrics  can  be  established. 
Additional  future  research  efforts  should  be  done  after  an  assessment  of 
any  gaps  or  shortcomings  associated  with  this  thesis  or  conclusions  that 
are  later  found  to  be  not  supported  or  require  further  review. 
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•  Immediate  consumer:  immediate  consumer  for  this  thesis  would  be  the 
Sacramento  Regional  Terrorism  Threat  Center,  the  Sacramento  Regional 
Office  of  Homeland  Security  and  the  Sacramento  Terrorism  Liaison 
Officer  program. 

•  HS  practitioners:  it  is  the  anticipation  and  hope  that  any  information  or 
recommendations  derived  from  this  thesis  would  be  useful  not  only  to  the 
Sacramento  Regional  Office  of  Homeland  Security,  but  to  any  other 
regional  organizations  engaged  in  the  collection  and  dissemination  of 
information  and  intelligence  in  terrorist/criminal  activities. 

E.  REVIEW  OF  RELEVANT  LITERATURE 

1.  Fusion  Centers 

Fusion  centers  have  begun  to  spread  throughout  the  nation  as  an  emergent 
response  to  a  need  for  more  local  intelligence  by  regional  responder  communities.  In 
response  to  this  perceived  need,  state  and  local  entities  began  to  create  their  own  fusion 
centers  in  an  attempt  to  gain  infonnation  that  they  felt  that  they  were  not  getting  from  the 
federal  government. 

The  United  States  Department  of  Justice  and  the  Department  of  Homeland 
Security  (DHS)  have  defined  fusion  centers  as:  "a  collaborative  effort  of  two  or  more 
agencies  that  provide  resources,  expertise,  and/or  information  to  the  center  with  the  goal 
of  maximizing  the  ability  to  detect,  prevent,  investigate,  apprehend,  and  respond  to 
criminal  and  terrorist  activity."4  The  federal  government  recognized  the  potential  benefit 
to  not  only  the  state  and  local  entities,  but  to  the  federal  government  as  well.  It  has 
facilitated  the  development  of  local  and  state  fusion  centers  by  providing  funding, 
resource  augmentation  and  technical  support. 


4  Fusion  Center  Guidelines,  Developing  and  Sharing  Information  and  Intelligence  In  a  New  Era, 
United  States  Department  Justice,  United  States  Department  of  Homeland  Security,  2006,  12. 
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a.  Funding 

The  federal  government,  through  the  DHS,  has  been  very  supportive  of 
fusion  centers  and  has  provided  a  great  deal  of  funding  for  this  effort.  Unfortunately, 
there  are  mixed  reviews  on  the  level  of  funding  support,  and  the  effectiveness  of  the 
funds  being  expended  for  the  value  of  return  or  return  on  investment.  In  his  keynote 
address  to  the  2007  National  Fusion  Center  Conference,  DHS  Secretary  Chertoff  said  that 
fusion  center  funding  should  not  be  seen  as  sustainment,  “we  are  not  signing  up  to  fund 
fusion  centers  in  perpetuity,”  and  that  the  centers  will  have  to  look  to  local  support  for 
continued  funding.  This  will  necessitate  recognition  by  local  officials  of  a  local  value  for 
these  centers  to  gain  needed  financial  support.5 

The  need  for  funding  to  sustain  the  fusion  centers  is  highlighted  in  the 
National  Criminal  Intelligence  Sharing  Plan  (NCISP),  which  states,  "Without  adequate 
funding,  many  of  the  recommendations,  including  improved  training  and  technical 
infrastructure,  will  not  implemented,  and  the  country  will  remain  at  risk.”  The  same 
recommendation  calls  for  a  petition  to  Congress  for  financial  support.6  The  need  for  an 
identified  and  long-term  funding  is  highlighted  by  the  GAO  report,  Homeland  Security, 
Federal  Efforts  are  Helping  to  Alleviate  Some  Challenges  Encountered  by  State  and 
Local  Information  Fusion  Centers.  The  report  states  that  fifty-four  of  the  fifty-eight 
fusion  centers  reported  challenges  in  obtaining  and  maintaining  funding.  Grant 
administration  restrictions  on  fusion  centers,  in  addition  to  navigating  the  grant  system, 
were  cited  as  a  problem.  The  report  also  called  on  the  Information  Sharing  Environment 
plans  to  rely  on  a  nationwide  network  of  state  and  local  fusion  centers,  but  no  long-term 
funding  for  such  an  undertaking  has  been  identified.  This  lack  of  commitment  is  making 
it  hard  on  local  efforts  to  commit  fully  to  the  fusion  center  concept.7 


5  Derived  from  transcript  of  Secretary  Chertoff  s  address,  as  referenced  by  the  CRS  report  by  Masse  et 
ah,  CRS  report  for  Congress,  44. 

6  The  National  Criminal  Intelligence  Sharing  Plan,  U.  S.  Department  of  Justice,  Bureau  of  Justice 
Assistance  and  Global  Justice  Information  Sharing  Initiative,  October  2003,  1 1-12. 

7  Homeland  Security,  Federal  Efforts  are  Helping  to  Alleviate  Some  Challenges  Encountered  by  State 
and  Local  Information  Fusion  Centers,  United  States  Government  Accountability  Office,  GAO-08-35, 
October  2007,  7-8. 
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In  contrast,  the  joint  publication  by  the  Departments  of  Justice  and 
Homeland  Security  report,  Fusion  Center  Guidelines,  Developing  and  Sharing 
Information  and  Intelligence  in  a  New  Era  (FCG),  specifically  places  responsibility  on 
local  centers’  administration  to  seek  out  funding  sources  for  long-term  continuity.8 

Matt  Bettenhausen,  Director  of  the  California  State  Office  of  Homeland 
Security,  identified  the  lack  of  sustained  funding  as  the  biggest  obstacle  to  the  continuing 
operation  of  state  and  local  fusion  centers.  He  argues  that  counterterrorism  has  always, 
first  and  foremost,  been  a  federal  obligation,  and  that  the  state  and  local  fusion  centers 
enhance  that  mission  in  a  material  way.  His  position  is  that  sustained  funding  for  fusion 
centers  is  a  minor  cost  with  a  significant  potential  benefit.9 

b.  Resource  Augmentation 

The  federal  government  resource  augmentation  for  fusion  centers  has 
come  primarily  from  two  agencies,  the  FBI  and  the  DHS.  The  FBI  has  provided  support 
to  the  fusion  center  effort  by  co-locating  staff  in  the  fusion  centers,  facilitating  the 
security  clearance  process  and  assisting  in  rent  payments  in  joint  occupancy  fusion 
centers.10 

As  an  example  of  the  support  and  the  growing  importance  of  fusion 
centers,  the  DHS,  in  addition  to  providing  direct  support  in  the  form  of  grant  dollars,  is 
committing  to  putting  a  DHS  analyst  in  all  state  and  local  fusion  centers.11  Participation 
in  the  fusion  center  process  assists  local  government  policy  makers  and  those  responsible 
for  the  protection  of  the  community  with  not  only  pertinent  intelligence  with  a  local 
application;  it  provides  an  opportunity  to  develop  networks  and  relationships  that  will  be 
critical  in  any  future  catastrophic  event.  This  concept  was  a  central  theme  in  the 
Improving  Information  report  from  LEAP: 


8  Fusion  Center  Guidelines,  63. 

9  Matt  Bettenhausen,  Director,  California  Office  of  Homeland  Security,  Interview,  January  3,  2008. 

10  Masse  et  al.,  CRS  report  for  Congress,  38. 

11  Charles  Allen,  DHS  Director  of  Intelligence,  Testimony  before  Senate  Select  Committee, 
September  7,  2006. 
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State,  local,  and  tribal  law  enforcement  participation  in  state  and  local 
fusion  centers  advances  the  cause  of  intelligence-led  policing  by  involving 
officers  in  the  intelligence  process  on  a  daily  basis;  helping  them  build 
relationships  across  every  level  and  discipline  of  government  and  the 
private  sector;  and  ensuring  that  law  enforcement  intelligence  and  other 
information  is  shared  with  their  home  communities.12 

Fusion  centers  emerged  almost  spontaneously  in  response  to  a  need  by 
state  and  local  law  enforcement  for  useful  and  usable  intelligence  related  to  the  evolving 
terrorist  threat.  This  position  was  reinforced  when  Norman  Beasley  testified  before  the 
House  of  Representatives: 

One  of  the  chief  complaints  of  state  and  local  officials  is  the  lack  of 
actionable  information  from  the  National  Intelligence  Community.  This  is 
exactly  why  state/local  fusion  centers  were  implemented.13 

c.  Technical  Support 

The  fusion  centers  started  independently  and  spontaneously  with  little 
regard  for  standardization,  intelligence  collection  and  production  methods,  analytical 
production  requirements,  analytical  staff  training,  roles  and  responsibilities,  or  a  defined 
mission.  Further,  there  is  little  integration  or  infonnation  sharing  from  one  fusion  center 
to  another.  The  goals  of  the  fusion  centers,  as  stated  in  the  CRS  report  summary,  is  that 
the  various  strains  of  information  flowing  into  the  fusion  center  need  to  be  "translated 
into  protective  action."14 

Historically,  local  law  enforcement  has  had  very  little,  if  any,  influence  or 
role  in  the  intelligence  community.  What  little  influence  or  participation  the  law 
enforcement  community  has  had  is  in  the  form  of  the  federal  law  enforcement 
community,  principally,  the  Federal  Bureau  of  Investigation.  Absent  that,  there  has  been 


12  A  Law  Enforcement  Assistance  and  Partnership  Strategy,  Improving  Information  Sharing  between 
the  Intelligence  Community  and  State,  Local,  and  Tribal  Law  Enforcement,  2, 
http://epic.org/privacy/fi.ision/leap.pdf.  Last  accessed  February  29,  2008. 

13  Beasley,  Testimony  before  the  U.S.  Maricopa  County  (Arizona)  Sheriff  s  Office. 

14  Masse  et  ah,  CRS  report  for  Congress,  summary  page. 
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very  limited  involvement  by  state  or  local  law  enforcement  in  the  intelligence  collection, 
analysis,  or  production  for  counterterrorist  activity. 

The  staff  that  the  FBI  and  DHS  have  assigned  to  the  state  and  local  fusion 
centers,  in  addition  to  being  a  resource  augmentation,  is  a  significant  form  a  technical 
assistance.  The  FBI  is  also  using  its  senior  analysts  to  train  the  local  analysts,  and  they 
are  using  their  staff  to  provide  assistance  and  guidance  in  the  development  of  the  fusion 
process  at  the  centers.15  While  conducting  the  research  for  this  thesis,  several  people 
throughout  the  Sate  of  California  and  outside  of  California  were  interviewed,  on  and  off 
the  record.  There  was  not  one  person  who  had  any  relevant  association  with  fusion 
centers  who  was  not  wholly  and  completely  pleased  with  the  FBI’s  commitment  to  state 
and  local  fusion  centers.  No  one  felt  excluded  or  anything  less  than  a  full  partner.  All 
four  of  the  California  FBI  field  offices  have  clearly  embraced  the  “information  sharing 
environment”  and  have  been  instrumental  in  assisting  state  and  local  fusion  centers  in 
their  development.  The  DHS  Intelligence  and  Analysis  staff  detailed  to  the  fusion  centers 
were  also  well  regarded,  although  they  are  much  newer  to  the  centers  and  there  are  far 
fewer  of  them  than  the  FBI  resources. 

The  federal  government  has  also  produced  several  reports  and  documents 
to  help  guide  the  development  and  professionalism  of  the  fusions  centers.  A  sample  of 
these  reports  include  the  National  Criminal  Intelligence  Sharing  Plan  and  the  Fusion 
Center  Guidelines,  Developing  and  Sharing  Infonnation  and  Intelligence  in  a  New  Era. 

The  Department  of  Homeland  Security  is  taking  several  steps  to  address 
the  lack  of  standardization,  uniformity,  mission  and  training,  in  addition  to  providing  on¬ 
site  staff  to  assist  in  the  development  of  the  centers.  The  DHS  has  created  seven  different 
technical  assistance  programs  that  respond  directly  to  these  identified  shortcomings  and 
has  addressed  the  issue  in  national  conferences.16 


15  Masse  et  al.,  CRS  report  for  Congress,  38. 

16  DHS  Fusion  Center  Conference,  Washington,  DC,  September  2007,  and  the  LEAD  ACT 
Conference  Quantico,  VA,  August  2007;  personal  communication,  Lt  Tim  Johnstone,  September  27,  2007. 
See  also  Masse  et  ah,  CRS  report  for  Congress,  Fusion  Centers:  41.  Additionally  DHS  has  funded  a  three- 
million-dollar  grant  to  provide  standardized  training  to  fusion  analysts,  which  was  awarded  to  the 
Sacramento  Region  in  2007. 
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The  FBI  and  DHS  have  also  made  available  their  classified  databases  to 
trained  and  qualified  (cleared)  personnel.  In  addition,  both  agencies  have  made  efforts  to 
increase  the  number  of  clearances  to  local  and  state  personnel  but  are  taking  steps  to 
improve  the  process.  Even  with  the  support  that  the  federal  government  has  given  fusion 
centers  there  are  issues  or  obstacles  that  remain  before  state  and  local  fusion  centers  can 
be  as  productive  and  relevant  as  had  been  anticipated. 

d.  Fusion  Process 

The  fusion  process,  as  described  by  the  Fusion  Center  Guidelines, 
Developing  and  Sharing  Information  and  Intelligence  in  a  New  Era  (FCG),  is  a  six-stage 
process.  The  FCG  based  their  to  fusion  process  on  the  Homeland  Security  Advisory 
Council’s  (HSAC)  Intelligence  and  Information  Sharing  Initiative:  Homeland  Security 
Intelligence  and  Information  Fusion.  The  process  in  the  FCG  is  described  as: 

•  the  first  stage,  management  and  governance,  establishes  the  foundation  of 
the  fusion  center 

•  the  second  stage,  planning  and  requirements,  establishes  what  type  of 
information  will  be  collected 

•  the  third  stage,  collection,  is  the  actual  collection  of  information  from  a 
variety  of  sources 

•  the  fourth  stage,  analysis,  is  where  information  is  turned  into  actionable 
intelligence 

•  the  fifth  stage,  dissemination,  tasking  and  archiving,  is  where  information 
is  disseminated  to  stakeholders 

•  the  sixth  stage  is  reevaluation,  where  the  fusion  center  and  stakeholders 
ensure  that  what  is  being  collected,  analyzed  and  disseminated  is  factual, 
timely  and  relevant 

•  the  seventh  stage  is  modification  where,  if  there  are  changes  during  the 
reevaluation,  they  are  implemented  here17 


17  Fusion  Center  Guidelines,  20-21. 
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The  intelligence  cycle  has  a  generally  accepted  process  with  a  few 
modifications  or  variances  from  entity  to  entity.  A  generally  accepted  model  is  presented 
below  from  Mark  Lowenthal's  (Lowenthal  is  a  recognized  expert  cited  by  the  CRS)  book 
Intelligence  from  Secrets  to  Policy. 

This  process  is  often  accepted  to  consist  of: 

•  requirements,  which  is  an  identification  of  need  and  priority,  long  term 
and  immediate 

•  collection,  which  is  the  method,  amount  and  source  of  infonnation 

•  processing  and  exploitation,  which  is  a  process  of  rendering  technical  data 
into  usable  fonnat 

•  analysis  and  production,  which  is  the  process  of  analysis  and  the  creation 
of  the  written  product 

•  dissemination  and  consumption,  which  is  the  distribution  and  assimilation 
of  the  product 

•  feedback,  which  is  infonnation  from  the  policymakers  concerning  how 
effective  the  product  fits  their  needs.18 

These  two  processes  are  very  similar  but  there  are  two  subtle  distinctions 
that  potentially  become  issues.  The  first  is  the  dissemination  step  in  the  Fusion  Center 
Guidelines.  In  Lowenthal’s  book,  he  identifies  this  step  as  dissemination  and 
consumption.  It  is  not  enough  to  get  the  product  to  the  proper  consumers,  it  must  come  in 
a  form  that  will  be  used  and  assimilated.  The  second  is  what  the  Fusion  Center 
Guidelines  refer  to  as  the  reevaluation  step,  which  is  basically  for  accuracy  and 
relevance;  whereas,  in  Lownethal’s  model,  he  identifies  a  feedback  step,  which  is 
ostensibly  analogous  to  the  reevaluation  step.  However,  the  feedback  step  clearly 
articulates  the  need  to  have  the  final  consumer  provide  input  on  the  usefulness  of  the 
product. 


18  Mark  M.  Lowenthal,  Intelligence,  From  Secrets  to  Policy ,  Washington,  DC:  CQ  Press,  2006,  54-67; 
this  is  a  synopsis  of  the  intelligence  cycle  as  described  in  this  work. 


11 


e.  Administration 

The  Fusion  Center  Guideline  number  three  recommends  that  each  fusion 
center  establish  a  governance  board  comprised  of  high-level  officials  from  law 
enforcement,  public  safety  and  the  private  sector.  One  of  the  relevant  issues  for 
consideration  is  that  a  governance  board  should  ensure  “defining  the  management 
structure  to  include  what  entity  oversees  the  centers,  manages  the  operations,  and 
coordinates  daily  activities.”19  There  are  no  recommendations  as  to  what  that 
management  structure  should  look  like. 

The  literature  is  very  weak  or  silent  on  the  issue  of  who  should  lead  fusion 
centers.  The  BJA  guidelines  state  that  fusion  centers  should  have  a  governance  board  of 
some  type  but  they  do  not  get  into  the  nuances  of  actual  leadership.  The  NCISP  states,  in 
the  first  recommendation,  that  the  agency  chief  executive  officer  and  the  manager  of 
intelligence  functions  should  define  the  management  and  supervision  of  the  center.  This 
concept  is  virtually  covered  in  a  bullet  point.20 

f  Mission 

The  mission  of  each  fusion  center  should  be  something  directly  related  to 
the  center’s  intended  goals.  What  will  be  as,  or  more,  important  as  the  mission,  is  how, 
or  by  what  process,  that  mission  is  derived.  The  FCG  list  several  issues  for  consideration 
such  as:  developing  the  mission  statement  in  a  collaborative  process;  identifying  the 
center  customers  and  their  needs,  and  defining  center  priorities  prior  to  drafting  the 
mission  statement;  and,  prioritize  the  intelligence  function  to  address  threats  in  the  local 
jurisdictions.21 

The  California  State  Terrorism  Threat  Assessment  System,  comprised  of 
the  State  Terrorist  Threat  Assessment  Center  (STTAC)  and  the  four  Regional  Terrorist 
Threat  Assessment  Centers  (RTTAC),  collaborated  on  a  concept  of  operations  plan  as  a 

19  Fusion  Center  Guidelines,  25. 

20  The  National  Criminal  Intelligence  Sharing  Plan,  U.  S.  Department  of  Justice,  Bureau  of  Justice 
Assistance  and  Global  Justice  information  Sharing  Initiative,  October  2003,  10. 

21  Fusion  Center  Guidelines,  23. 
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guiding  principle  for  all  five  of  the  threat  assessment  centers,  which  also  function  as 
fusion  centers.  As  part  of  that  concept  of  operations,  a  mission  statement  and  a  vision 
statement  is  included.  The  mission  statement  is: 

The  mission  of  the  state  terrorism  threat  assessment  system  is  to  foster  a 
collaborative  effort  to  collect  and  analyze  criminal  infonnation,  employ 
cutting-edge  analytical  tools  and  methodologies  to  produce  and  share 
timely  and  actionable  Homeland  Security  intelligence,  thereby  enhancing 
the  safety  of  the  citizens  of  California.22 

g.  All  Crime  Vs  Strictly  Counterterrorism 

The  vast  majority  of  fusion  centers,  however,  have  taken  an  all-crimes 
approach  to  fusion  analysis  within  their  jurisdictions  (all  crimes  rarely  means  “all 
crimes,”  but  is  usually  meant  to  be  certain  organized  crimes  or  major  crimes  such  as 
narcotics,  crimes  of  violence  and  gangs,  or  crimes  that  may  be  used  to  support  terrorism 
efforts  here  or  abroad  such  as  financial  crimes  or  fraud.  Strictly  counterterrorism  is  meant 
to  be,  for  this  thesis,  crimes  that  are  terrorist  acts  or  those  in  which  the  association  to 
terrorism  is  apparent  at  face  value).  The  CRS  report  for  Congress,  Fusion  Centers: 
Issues  and  Options  for  Congress,  reported  that  less  than  15  percent  of  current  fusion 
centers  operate  with  a  solely  counterterrorism  posture.  The  report  identified  some  of  the 
reasons  for  this  as  a  national  trend,  need  for  local  and  non-law  enforcement  buy-in,  and 
the  need  for  resources  23  The  same  report  also  stated  that  “most  police  departments  and 
public  sector  agencies  are  more  concerned  with  issues  such  as  gangs,  narcotics,  and  street 
crime,  which  are  more  relevant  to  their  communities.”24 

A  GAO  report  published  in  October  2007  also  reported  the  vast  majority 
of  fusion  centers  —  forty-one  of  the  forty-three  that  were  contacted  —  stated  that  they 
operated  as  “broader  than  solely  focusing  on  counterterrorism.”  Twenty-two  of  the 
center  officials  stated  they  included  criminal  activity  in  their  mission,  and  nineteen  said 

22  Strategic  Business  Plan  Concept  of  Operations,  California  State  Terrorism  Threat  Assessment 
System,  nd,  3. 

23  Masse  et  al.,  CRS  report  for  Congress,  21. 

24  Ibid. 
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they  included  an  all-hazards  focus  in  addition  to  counterterrorism.  It  was  unclear  whether 
the  all-hazards  fusion  centers  included  a  criminal  perspective  as  well.  The  reasons  cited 
for  including  the  criminal  mission  were  basically  the  position  that  there  is  a  nexus 
between  criminal  conduct  and  terrorist  behavior,  and  that  one  may  uncover  the  other.  A 
second  reason  cited  was  to  gain  more  support  and  stakeholders  such  as  law 
enforcement.25 


h.  Strategic  Vs  Tactical  Analysis 

The  fact  that  these  terms  need  to  be  defined  underscores  a  large  problem 
with  fusion  centers  and  their  mission.  There  is  no  commonly  understood  and  universally 
accepted  definition  for  the  term  strategic  analysis  or  tactical  analysis.  As  described  by  a 
career  intelligence  analyst,  the  absence  of  an  accepted  term  is  “part  of  the  problem.”  This 
analyst  prefers  the  tenn  “all  source  analyst”  over  “true”  intelligence  analyst  when 
referring  to  strategic  analysis  as  the  tenn  “true”  can  be  unintentionally  pejorative.26  For 
the  purposes  of  this  thesis,  strategic  analysis  is  analysis  of  disparate  data  sources, 
identification  of  intelligence  gaps,  pro-active  collection  of  intelligence,  and  predicative 
analysis  of  an  act  or  occurrence  with  recommendations  or  sufficient  substance  to  guide 
policy.  The  strategic  analyst  must  rely  on  his  or  her  expertise  and  thorough  knowledge  of 
their  respective  domain  to  fill  knowledge  gaps.  Tactical  analysis  is  research  and  analysis 
on  events  that  have  already  occurred  and  are  not  predictive;  it  is  predominantly 
investigative  case  support  or  an  analytical  assessment  of  a  variety  of  data  inputs. 

David  Carter,  in  his  book  Law  Enforcement  Intelligence:  a  Guide  for 
State,  Local,  and  Tribal  Law  Enforcement  Agencies,  offers  a  definition  for  strategic  and 
tactical  law  enforcement  intelligence.  He  describes  strategic  as  having  a  planning  and 
resource  allocation  function  that  provides  infonnation  to  decision  makers  about  the 
changing  nature  of  threats  and  the  characteristics  and  methodologies  of  threats  for  the 

25  Homeland  Security,  “Federal  Efforts  are  Helping  to  Alleviate  Some  Challenges  Encountered  by 
State  and  Local  Information  Fusion  Centers,”  United  States  Government  Accountability  Office,  GAO-08- 
35,  October  2007,  18-19. 

26  Personal  communication,  with  a  confidential  source  who  is  a  career  intelligence  analyst,  February 
22,  2008. 
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purpose  of  developing  response  strategies  and  resource  allocation.  Tactical  intelligence 
is  described  as  having  a  preventive  function  to  gain  infonnation  to  apprehend  offenders, 
harden  targets,  and  use  strategies  that  will  eliminate  or  mitigate  the  threat.27 


Both  the  National  Criminal  Intelligence  Sharing  Plan  and  the  Fusion 
Center  Guidelines,  Developing  and  Sharing  Information  and  Intelligence  in  a  New  Era, 
skirt  the  distinction  between  tactical  and  strategic  analysts  and  do  not  offer  a  definition  of 
the  two  entities.  The  Fusion  Center  Guidelines  make  a  recommendation  that  a  center 
provide  both  tactical  and  strategic  products.  The  Fusion  Center  Guidelines  recommend 
that  the  center  should  have  a  strategic  capability  as  well  as  a  tactical  capability  and  that 
intelligence  functions  should  prioritize  their  efforts  based  on  threats  specific  to  the 
center’s  area  of  concern.28 

The  majority  of  fusion  centers  operate  exclusively  in  an  analytical 
capacity  rather  than  as  having  any  response  or  operational  capacity.  Those  few  fusion 
centers  that  do  have  a  response  capability  were  generally  found  to  be  fusion  centers  that 
were  state-controlled,  single  entity,  and  largely  staffed  by  law  enforcement  personnel. 
The  scope  of  analysis  that  the  fusion  centers  focus  their  efforts  on  has  a  great  range  of 
variability.  Again,  the  majority  of  fusion  centers  that  conducted  their  analysis  for  the 
purposes  of  prevention  considered  their  responsibilities  to  be  information  sharing, 
assessments  and  analysis,  and  to  facilitate  preparedness  efforts. 

To  accomplish  this,  fusion  centers  operate  as  “filtering  stations”  to  pass 
along  information,  but  some  fusion  centers  add  local  information  to  enhance  the  product. 
Some  fusion  centers  added  analytic  value  while  others  provided  case  support  to  law 
enforcement  agencies.  None  of  the  fusion  centers  appeared  to  be  using  all  of  the  steps  in 
the  intelligence  cycle29 


27  David  L.  Carter,  Law  Enforcement  Intelligence:  a  Guide  for  State,  Local,  and  Tribal  Law 
Enforcement  Agencies,  U.S.  Department  of  Justice,  Office  of  Community  Oriented  Policing,  Cooperative 
Agreement  #2003-CK-WX-0455,  November  2004,  8. 

28  Fusion  Center  Guidelines,  57. 

29  Masse  et  al.,  CRS  report  for  Congress,  Fusion  Centers:  23-24. 
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i.  Analysts 


The  Fusion  Center  Guidelines,  in  guideline  number  eleven,  recommend 
hiring  staff  that  can  perform  both  tactical  and  strategic  analytical  functions.  Under 
“issues  for  consideration”  of  the  same  guideline,  the  report  recommends  that 
consideration  be  given  to  establishing  a  permanent,  full-time  civilian  presence  to  provide 
continuity  and  consistency.  The  guideline  also  recommends  requiring  a  minimum  term 
commitment  for  full-time  personnel  and  recommends  that  the  center  obtain  the 
appropriate  clearance  requirements  as  needed  for  staff  to  do  their  job.30 

The  NCISP  stated  that  there  is  a  need  to  develop  standards  of  training,  not 
only  for  the  analysts  and  those  assigned  to  the  fusion  center,  but  also  for  those  who  are 
associated  with  it.  In  fact,  the  NCISP  recommended  minimum  training  standards  in  its 
recommendation  section.  The  NCISP  has  highlighted  the  need  for  the  analytical  function 
of  the  fusion  centers  to  follow  the  intelligence  cycle  and,  further,  it  calls  for  "appropriate 
training  for  all  personnel  assigned  to  or  impacted  by  the  intelligence  process."31  The 
NCISP  established  a  six-level  intelligence  training  standard:  level  1  is  for  law 
enforcement  officers;  level  2  is  for  law  enforcement  executives;  level  3  is  for  intelligence 
commanders/supervisors;  level  4  is  for  intelligence  officers/collectors;  level  5  is  for 
intelligence  analysts;  and,  level  6  is  for  train  the  trainer. 

Level  5  training  objectives,  are  in  part:  the  intelligence  process;  handling 
of  criminal  intelligence  information;  critical  thinking  and  inference  development; 
collection  and  analytical  plans;  legal,  privacy  and  ethical  issues;  research  methods;  and 
methodologies  of  analysis.  The  standard  requires  a  minimum  of  forty  hours  of  training 
that  should  be  delivered  in  a  classroom  environment.32  The  NCISP  further  supports  the 
need  for  standardized  training,  calling  for  the  IALEIA  to  develop  minimum  standards  for 
analysts  in  recommendation  number  twelve. 


30  Fusion  Center  Guidelines,  51. 

31  The  National  Criminal  Intelligence  Sharing  Plan,  10. 

32  Ibid.,  39. 
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Dissemination 


Dissemination  of  any  intelligence  product  is  quite  possibly  the  most 
critical  piece  of  the  process,  but  one  that  can  easily  be  overlooked  by  assuming  “it”  will 
just  happen.  According  to  the  NCISP,  "dissemination  is  also  a  vital  step  in  the  process. 
Without  disseminating  intelligence  developed  it  is  pointless  to  collect  it.  The  intelligence 
disseminated  must  be  timely  and  credible  to  be  useful."33  It  was  further  recommended, 
as  part  of  recommendation  number  one,  that  all  fusion  centers  "implement  a 
method/system  for  dissemination  of  information  to  appropriate  components/entities."34 

The  topic  of  dissemination  has  had  several  different  authorities  weigh  in 
on  the  topic  such  as  the  following  quote  from  Intelligence-Led  Policing:  The  New 
Intelligence  Architecture:  "Information  sharing  must  become  a  policy,  not  an  informal 
practice.  Most  important,  intelligence  must  be  contingent  on  quality  analysis  of  data."35 
Probably  the  most  authoritative  citation  comes  from  the  9/11  Commission  Report :  “The 
biggest  impediment  to  all-source  analysis  —  to  a  greater  likelihood  of  connecting  the 
dots  —  is  the  human  or  systemic  resistance  to  sharing  information.”36 

Dissemination  of  information  and  intelligence  product  is  not  only  an 
extremely  necessary  part  of  the  intelligence  process,  it  is  also  one  that  is  not  without 
controversy.  One  area  of  potential  conflict  is  the  level  at  which  different  emergency 
responder  groups  should  receive  information.  One  of  the  few  resources  to  address  this 
directly  is  the  Fusion  Center  Guidelines  released  in  August  of  2006,  which  states  that, 
even  though  fusion  centers  will  have  many  different  partners,  not  all  partners  need  nor 
should  receive  dissemination  of  information  and  intelligence  at  the  same  level,  stating 
"each  discipline  will  not  need  the  same  level  of  detail.”37 


33  The  National  Criminal  Intelligence  Sharing  Plan,  7. 

34  Ibid.,  10-11. 

35  U.S.  Department  of  Justice,  Intelligence-Led  Policing:  The  New  Intelligence  Architecture.  U.S.  DOJ 
website,  www.ojp.usdoi.gov,  September  2005,  viii. 

36  The  9/1 1  Commission  Report:  Final  Report  of  the  National  Commission  of  Terrorist  Attacks  Upon 
the  United  States,  416. 

37  Fusion  Center  Guidelines,  14. 
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2. 


Data  Collection 


A  great  deal  of  support,  politically  and  financially,  has  been  directed  toward  the 
fusion  center  concept;  it  is  not  only  prudent  but  an  obligation  to  make  every  effort  to 
maximize  our  opportunities  for  success.  The  tremendous  expenditure,  in  both  money  and 
resources  that  have  been  put  into  fusion  centers,  begs  the  question:  How  do  we  maximize 
the  value  of  fusion  centers?  Many  have  made  the  proposition  that  law  enforcement  and 
the  emergency  responder  community  as  a  whole  can  make  a  significant  contribution  to 
protecting  the  homeland  by  becoming  a  source  for  information  collection. 

It  has  been  widely  held  and  acknowledged  that  America’s  emergency  responders 
have  a  great  capacity  for  interacting  with  the  public  they  serve  —  much  more  intimately 
than  their  federal  counterparts.  What  has  been  less  well  understood,  until  recently,  is 
their  potential  for  contribution  to  the  counterterrorism  effort.  This  point  is  concisely 
illustrated  in  the  Markle  report: 

Most  of  the  real  frontlines  of  homeland  security  are  outside  of  Washington 
D.C.  Likely  terrorists  are  often  encountered,  and  the  targets  they  might 
attack  are  protected,  by  local  officials  —  a  cop  hearing  a  complaint  from  a 
landlord,  an  airport  official  who  hears  about  a  plane  some  pilot  trainee  left 
on  the  runway,  an  FBI  agent  puzzled  by  an  odd  flight  school  student  in 
Arizona,  or  an  emergency  room  resident  trying  to  treat  patients  stricken  by 
an  unusual  illness.38 

Maximizing  our  opportunity  for  a  successful  interdiction  of  a  terrorist  plot  may 
well  lie  in  making  better  use  of  the  large  number  of  emergency  responders  with  close  ties 
and  information  links  to  their  communities.  Brian  Jenkins  made  the  point  in  his  seminal 
work,  Unconquerable  Nation. 

Clearly,  we  need  to  enhance  the  intelligence  capabilities  of  local  police, 
not  just  those  of  the  FBI.  The  more  than  600,000  sworn  police  officers  in 
the  United  States  are  in  the  best  position  to  monitor  potential  homegrown 
terrorists.  An  entire  terrorist  plot  may  proceed  under  the  radar  of  national 


38  Markle  Foundation  Task  Force,  “Protecting  America’s  Freedom  in  The  Information  Age:  A  Report 
of  the  Markle  Foundation  Task  Force”  (New  York,  New  York,  October  2002),  10. 
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intelligence  services.  Therefore,  it  is  necessary  to  enhance  domestic 
intelligence  collection  and  analysis  capabilities.39 

Equally  important  to  the  sheer  numbers  of  emergency  responders  is  the 
knowledge  of  the  “beat”  or  area  they  work  and  their  developed  ability  to  see  the 
abnonnal.  Jenkins  reflects  on  this  idea  as  well: 

They  know  their  territory.  Recruited  locally,  they  are  likely  to  be 
ethnically  closer  to  the  communities  they  serve,  they  are  more  aware  of 
local  changes,  and  they  are  more  acceptable  to  local  community  leaders. 

Unlike  federal  agents,  local  police  do  not  rotate  to  another  city  every  few 
years.  They  are  in  the  best  position  to  identify  “hot  spots”  for  terrorist 
recruiting,  talk  to  local  merchants  and  community  leaders,  and  develop 
local  sources  of  intelligence.  As  we  have  seen  in  many  cases,  local  police, 
through  routine  criminal  investigations,  community  policing,  or  dedicated 
intelligence  efforts,  may  be  the  first  to  pick  up  leads  to  terrorist  plots.40 

A  great  deal  has  been  written  about  fusion  centers  and  the  need  to  involve  our 
emergency  responder  community,  particularly  law  enforcement.  Much  less  has  been 
written  about  how  we  are  actually  going  to  engage  this  community  of  responders.  The 
CRS  report  on  Homeland  Security  Intelligence  reinforces  this  point  when  it  states  that  the 
need  for  equal  information  sharing  is  critical  between  federal  and  local  partners  but: 

Yet  such  an  approach  also  implies  a  level  of  information  sharing  between 
federal,  state,  local,  tribal,  and  private  sector  information  collection 
entities  that  does  not  appear  to  exist  currently.41 

The  value  of  information  coming  from  the  emergency  responder  (ER) 
community,  or  as  would  be  identified  by  the  CRS  report  —  nontraditional  source  data  — 
is  illustrated  by  the  fact  that  the  CRS  report  lists  as  one  of  the  four  fusion  center  value 
propositions: 


39  Brian  Jenkins,  An  Unconquerable  Nation  (Santa  Monica,  CA:  RAND  Corporation,  2006).  164. 

40  Ibid.,  166. 

41  See  National  Governor’s  Association,  Center  for  Best  Practices,  2006  State  Homeland  Security 
Directors  Survey,  April  3,  2006,  as  reported  in  Masse  et  al.,  CRS  Report  for  Congress,  “HLS  Intelligence: 
Perceptions,  Statutory  Definitions,  and  Approaches,”  August  18,  2006,  17-18. 
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State,  local  and  tribal  law  enforcement  and  public-sector  agencies  are  in  a  unique 
position  to  make  observations  and  collect  information  that  may  be  central  to  the  type  of 
threat  assessment  referenced  above  [comprehensive  threat  picture].42 

However,  as  important  as  getting  infonnation  from  the  local  ER  community,  or 
the  nontraditional  source  data,  to  the  fusion  center  has  been  identified,  it  remains  an 
elusive  objective  at  many  locations,  and  in  any  substantial  way.  This  is  supported  by  the 
CRS  report  "moreover,  the  development  of  a  process  for  gathering  infonnation  according 
to  clearly  defined  information  requirements  and  fusion  centers  remains  nascent."43 

One  method  of  field  data  collection  that  is  being  used  with  some  degree  of 
positive  results  is  the  Tenorism  Liaison  Officer  (TLO)  program.  There  has  not,  as  yet, 
been  very  much  scholarly  research  conducted  on  TLOs;  however,  the  program  will  be 
reported  on  later  in  this  thesis. 

a.  Community-Oriented  Policing  (COP) 

COP  has  evolved  over  the  past  twenty  years  and  has  many  different 
definitions  and  applications.  The  COP  and  Problem  Solving  division  of  the  California 
Attorney  General's  Office  defines  COP  as:  "philosophy,  management  style,  and 
organizational  design  that  promotes  proactive  problem-solving  and  police-community 
partnerships  to  address  the  causes  of  crime  and  fear  as  well  as  other  community  issues."44 
This  philosophy,  as  espoused  by  the  Attorney  General’s  office,  places  great  emphasis  on 
problem-solving  and  community  partnerships  with  the  philosophy  of  the  supportive  law 
enforcement  management. 

Scheider  and  Chapman  offer  an  efficient  definition  of  COP: 

There  is  no  one  commonly  recognized  definition  of  community  policing. 

Here  we  offer  one  possible  definition  that  we  will  then  apply  to  preventing 

and  responding  to  terrorist  events.  Community  policing  can  be  defined  as 

42  Masse  et  at.,  CRS  report  for  Congress,  4. 

43  Ibid.,  5. 

44  Community  Oriented  Policing  and  Problem  Solving,  Definitions  and  Principles,  California  Attorney 
General's  office,  1999,  3. 
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a  philosophy  that,  through  the  delivery  of  police  services,  focuses  on 
crime  and  social  disorder;  the  philosophy  includes  aspects  of  traditional 
law  enforcement  as  well  as  prevention,  problem-solving  tactics,  and 
partnerships.45 

Scheider  and  Chapman  also  make  a  concise  and  accurate  assessment  of 
the  COP  philosophy,  which  they  describe  as  having  three  interrelated  elements  of: 
"organizational  change,  problem-solving,  and  external  partnerships."46  A  new 
organizational  structure  will  help  the  rank-and-file  officers  if  it  allows  them  the  freedom 
to  take  self-initiated  activity  and  act  on  their  observations  of  potentially  suspicious 
behavior.  Acting  on  the  officers’  developed  powers  of  observation  for  what  is  “not 
right,”  enhanced  with  awareness  level  training,  will  ultimately  lead  to  increased 
investigative  tips  and  leads.  Problem  solving,  which  was  the  forerunner  of  COP  and  a 
cornerstone  of  the  tactical  effectiveness  of  COP,  has  helped  both  line-level  officer  and 
detectives  to  think  more  analytically,  with  an  end  toward  finding  a  solution  to  a  problem, 
rather  than  making  a  short-term  fix  with  an  arrest. 

While  problem  solving  yielded  the  greatest  tactical  benefits,  fonning 
external  relationships  forged  huge  inroads  in  establishing  links  with  the  community.  The 
public  relations  capital  and  support  for  law  enforcement  was  unprecedented.  How  do  we 
trade  on  the  community  capital  of  good  will  created  by  COP,  and  how  do  we  make  that 
work  in  the  collection  of  information  useful  to  counter  terrorist  action? 

What  is  the  role  of  community-oriented  policing  in  homeland  security  and 
the  prevention  of  domestic  terrorism?  Docobo  presented  this  question  in  his  article 
Community  Policing  as  the  Primary  Process  and  Strategy  for  Homeland  Security  at  the 
Local  Law  Enforcement  Level  by  stating:  "while  some  have  suggested  that  community 
policing  fit  into  the  overall  national  strategy  for  homeland  security,  little  research 
specifically  identifies  community  policing  strategies  and  their  direct  application  to  the 


45  Matthew  C.  Scheider,  and  Robert  Chapman,  “Community  Policing  and  Terrorism,”  retrieved  from 
http://www.homelandsecurity.org/journal/articles/Scheider-Chapman.html,  April  2003,  last  retrieved 
September  27,  2007,  2. 

46  Ibid.,  1. 
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national  strategy  for  homeland  security."47  Many  are  fond  of  saying  that  COP  is  a 
valuable  tool  in  counterterrorism  but  few  have  made  the  case. 


b.  Hypothesis 

If  no  action  is  taken  to  assist  fusion  centers  in  producing  locally  relevant 
intelligence  products,  they  will  eventually  lose  support  from  the  local  law  enforcement 
community,  which  will  ultimately  negatively  affect  the  value  of  their  product.  This  will, 
in  turn,  create  even  more  funding  challenges  to  continue  federal  support  for  the  fusion 
centers.  If  the  intelligence  product  produced  by  the  local  fusion  centers  is  not  locally 
actionable,  the  fusion  centers  will  be  relegated  to  being  little  more  than  local  mouthpieces 
for  generic,  federally  produced  trends. 

It  is  anticipated  that  this  would  create  a  loss  of  support  from  the 
sponsoring  agencies,  of  which  the  majority  are  state  and  local  law  enforcement  agencies. 
If  the  fusion  centers  prove  themselves  to  be  less  than  full  and  valued  members  of  the 
intelligence  community,  the  partnerships  established  in  the  fusion  centers  will  likely 
break  apart,  unwilling  to  expend  valuable  resources  with  little  return.  The  multi-agency 
and  multi-levels  of  governments  that  are  currently  participating  will  re-allocate  their 
resources,  relegating  the  host  agency  to  a  crime  analysis  center  rather  than  an  intelligence 
fusion  center.  This  distinction  would  render  their  counterterrorist  potential  moot, 
particularly  if  the  FBI  were  to  disengage. 

c.  Methodology  and  Resources 

The  methodology  for  this  thesis  is  a  program  of  evaluation,  utilizing  a 
formative  approach  to  review,  evaluate,  and  suggest  improvements  for  fusion  centers  and 
TLO  programs  in  general  and  the  Sacramento  region  in  particular.  The  questions  were: 
what  are  the  strengths  and  weaknesses  of  fusion  centers,  particularly  those  associated 


47  Jose  Docobo,  “Community  Policing  as  the  Primary  Prevention  Strategy  for  Homeland  Security  at 
the  Local  Law  Enforcement  Level,  ”  Homeland  Security  Affairs  1,  no.  1,  summer  2005,  3. 
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with  the  California  State  Terrorism  Threat  Assessment  System,  as  well  as  other  existing 
programs  and,  just  as  importantly,  what  can  be  done  to  improve  those  programs? 
My  methodology  will  be  as  outlined  below. 

Much  of  the  analysis  portion  of  this  thesis  will  focus  on  the  California 
State  Terrorism  Threat  Assessment  System,  which  consists  of  the  State  Terrorism  Threat 
Assessment  Center  (STTAC)  and  the  four  regional  terrorism  threat  assessment  centers 
(RTTAC).  The  four  RTTACs  are  the  Northern  California  RTTAC  located  in  the  San 
Francisco  Bay  Area,  the  Sacramento  RTTAC,  the  Los  Angeles  RTTAC  and  the  San 
Diego  RTTAC.  The  four  RTTACs  are  geographically  aligned  with  the  FBI  field  offices 
and,  consequently,  the  U.S.  Attorney's  office. 

d.  Literature  Review 

The  first  step  of  the  methodology  for  this  thesis  will  be  to  continue  the 
literature  review.  Specifically,  the  research  will  continue  to  investigate,  in  greater  depth 
and  on  a  broader  range,  what  variety  of  intelligence  collection  methods  are  being  used  by 
what  agencies,  and  in  what  capacity  and  with  what  degree  of  success.  Further,  review 
will  focus  on  fusion  centers  and  their  local  or  regional  operational  procedures  as  well  as 
their  intelligence  production,  examining  the  end  product  and  its  regional  application,  and 
the  relevant  usefulness  of  this  infonnation  to  the  local  emergency  responder  community 
and  administrators.  The  research  will  cover  anything  relating  to  fusion  centers  and  local 
information/intelligence  gathering,  particularly  as  it  relates  to  any  terrorism  nexus. 

e.  Survey 

Surveys  are  the  second  component  of  the  methodology  and  will  be 
conducted  in  conjunction  with  the  interview  and  observation  portion  of  my  research.  I 
have  surveyed  the  STTAC  and  all  four  RTTACs.  Commanders  of  the  respective  centers 
completed  the  surveys.  Questions  raised  and  answered  in  the  survey  are: 

1)  Who  are  your  consumers? 

2)  What  is  the  primary  function  of  each  fusion  center?  Should  they  be 
all  crimes  or  purely  counterterrorist? 
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3)  Is  their  mission  tactical  or  strategic? 

4)  By  what  methods  do  they  receive  taskings  and  from  whom? 

5)  How  do  they  disseminate  infonnation  and  to  what  purpose? 

6)  How  do  the  fusion  centers  collect  infonnation  from  their 
emergency  responder  community  and  are  those  processes 
satisfactory? 

In  some  cases,  respondents  did  not  answer  one  or  more  of  the  survey 
questions.  This  seemed  to  occur  with  greater  frequency  later  in  the  survey,  it  is  unknown 
if  this  was  survey  fatigue  or  if  it  had  to  do  with  the  individual  question.  No  particular 
fusion  center  had  a  pattern  of  skipping  questions.  Eight  questions  had  one  skip,  one 
question  had  two  skips  and  one  question  had  three  skips.  A  total  of  twenty-eight 
questions  were  asked.  The  survey  was  conducted  via  SurveyMonkey  with  the  four 
RTTACs  and  the  STTAC  (herein  after  referred  to  as  survey). 

The  respondents  were  advised  that  their  individual  responses  would  be 
kept  confidential  unless  they  specifically  indicated  the  responses  could  be  attributed. 
This  was  done  to  encourage  as  complete  a  disclosure  as  possible.  A  copy  of  the  survey  is 
attached  in  Attachment  A. 

f  Interviews 

The  interviews  included  the  director  of  the  California  State  Office  of 
Homeland  Security,  five  RTTAC  commanders  (two  from  LA),  TLO  coordinators  from 
the  RTTACs,  and  a  variety  of  law  enforcement  administrators.  The  objective  was  to 
determine  their  expectations  of  the  fusion  centers  and  tasking,  as  well  as  their 
understanding  of  the  current  system  and  their  expectations.  Interviews  were  also 
conducted  with  educators  in  the  field  and  practicing  analysts.  The  interviews  were 
qualitative  and  unstructured,  following  basic  thematic  lines;  each  respondent  represented 
a  different  area  of  expertise. 
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II.  SURVEY  RESULTS 


Fusion  center  managers  work  in  a  classified  environment  where  few  others  have 
access.  They  know  what  infonnation  is  available  from  the  federal  classified  databases, 
open  sources,  classified  human  intelligence,  and  local  information  sources.  The  fusion 
center  managers  also  know  what  cases  are  being  investigated,  and  what  type  and  quality 
of  information  is  needed  to  fill  their  threat  assessment  gaps  —  as  well  as  assist  their 
investigative  capacity.  For  this  reason,  the  respective  RTTAC  commanders,  or  co¬ 
managers,  were  chosen  as  the  survey  respondents.  In  the  case  of  the  STTAC,  the 
respondent  was  a  designee.  All  respondents  identified  their  organizations  as  fusion 
centers. 

The  survey  revealed  that  most  fusion  center  respondents  believe  that  law 
enforcement  and  investigators  are  their  primary  customers,  but  that  they  will  provide 
strategic  assessment  to  policy  makers  as  need.  The  majority  also  has  an  all-crimes 
perspective  and  felt  that  to  do  otherwise  would  minimize  their  value  to  their  customer 
base.  They  also  felt  that  the  emergency  responder  community  had  valuable  information 
to  share  and  that,  in  fact,  the  largest  source  of  local  data  that  they  relied  on  came  from 
law  enforcement  and  TLOs.  The  fusion  centers  also  reported  that  they  had  developed 
appropriate  reporting  mechanisms,  but  that  the  emergency  responders  were  not  reporting 
up  to  expectations.  Community-oriented  policing  contributed  very  little  to  the 
counterterrorism  effort. 

All  of  the  fusion  centers  had  a  TLO  program  with  both  fire  and  law  enforcement. 
Law  TLOs  provided  more  tips  and  information  collection,  while  fire  TLOs  provided 
more  administrative  support  and  line-level  education. 

A.  SURVEY  RESPONSES 

1.  Who  are  Your  Consumers? 

In  response  to  the  question,  “who  are  the  primary  consumers  of  your  product,”  the 

survey  overwhelmingly  identified  investigators  and  law-enforcement  as  their  primary 

customer.  Fifty  percent  of  those  responding  to  this  survey  question  identified  law- 
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enforcement  and  investigators  as  “always”  the  primary  consumer  of  their  product. 
Whereas  75  percent  of  the  respondents  indicated  that  policymakers  were  “often” 
consumers  of  their  product.  Non-law-enforcement  emergency  responders  had  a  range  of 
responses,  from  25  percent  saying  that  they  were  “seldom”  consumers  of  their  product,  to 
50  percent  identifying  the  non-law  enforcement  responder  community  as  “often”  a 
consumer,  and  25  percent  identifying  them  as  consumers  “most  of  the  time”  (one 
respondent  skipped  this  question).  Two-thirds  of  the  respondents  identified  elected 
officials  as  “seldom”  a  consumer  of  their  product  (two  respondents  skipped  this  portion 
of  the  question). 


Primary  Consumer  of  Fusion  Center  Product 
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Figure  1.  Fusion  product  consumers. (From  STTAC/RTTAC  Survey) 

2.  What  is  the  primary  function  of  each  fusion  center?  Should  they  be 
all  crimes  or  purely  counterterrorist? 

The  survey  indicates  that  the  majority  of  the  centers,  60  percent,  engage  in  an  all 

crimes  perspective  for  fusion  center  operations.  One  of  the  exclusively  counter  terrorist 

perspectives  was  Los  Angeles  (noted  with  permission),  which  investigates  and  analyzes 

counterterrorist  activity  but  also  considers  criminal  activity  with  a  terrorist  nexus  such  as 

26 


financial  crimes  (they  maintain  connectivity  via  the  TLO  program  with  officers  in  the 
various  investigative  units).  For  the  fusion  centers  that  have  an  all  crimes  perspective,  75 
percent  of  the  respondents  identified  financial  crimes  and  gangs  as  crimes  that  they 
conduct  analysis  on.  Narcotics,  crimes  of  violence,  and  counterfeiting  (other  than 
money)  were  all  identified  50  percent  of  the  time  as  crimes  that  the  fusion  centers 
worked.  One  respondent  skipped  this  question. 


Unit  Focus  on  Crimes  other  than  T errorist  Threats 


Figure  2.  Criminal  focus  of  all  crimes  fusion  centers.  From  STTAC/RTTAC  survey 


For  the  all  crime  fusion  centers,  only  50  percent  had  a  policy  that  guided  the 
decision  on  what  crime  or  case  would  be  analyzed.  The  remaining  centers  relied  on  the 
supervisor,  director  or  analysts  to  make  the  decision.  The  response  to  the  question 
(which  provided  for  a  narrative  response)  of  whether  there  was  sufficient  purely 
counterterrorist  activity  to  consistently  support  a  fully  staffed  fusion  center  was  mixed. 
Two  responded  yes,  one  responded  no,  the  fourth  replied  that  fusion  centers  should  be  all 
crimes,  and  one  skipped  the  question. 
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The  survey  data  also  suggests  that  useable  intelligence  product  would  be  lost  if 
their  center  were  to  focus  exclusively  on  counterterrorist  activity.  Fifty  percent  of  the 
reporting  fusion  centers  stated  that  “usually”  or  “almost  always”  would  there  be  a  loss  of 
intelligence  data.  Fifty  percent  also  felt  that  value  to  consumers  would  “usually”  or 
“almost  always”  be  reduced  and  25  percent  felt  that  “sometimes”  the  value  to  consumer 
would  be  reduced. 

3.  Is  their  mission  tactical  or  strategic? 

The  data  from  the  survey  indicates  that  60  percent  of  the  fusion  centers  had  both  a 
strategic  and  a  tactical  capability  with  two  respondents  skipping  the  question.  This 
finding  was  supported  by  the  interviews  from  the  commanders  of  the  four  RTTACs.  The 
Bay  Area  RTTAC  and  the  Sacramento  RTTAC  primarily  do  investigative  tactical  case 
support,  but  they  do  some  strategic  analysis  on  request  or  when  they  deem  such  a  need 
exists.  The  LA  RTTAC  does  some  investigative  case  support  but  primarily  provides 
strategic  analysis.  While  the  San  Diego  RTTAC  does  purely  strategic  support. 

4.  By  what  methods  do  they  receive  taskings  and  from  whom? 

This  question  was  posed  requiring  a  narrative  response  of  which  four  of  the  five 
centers  responded.  None  of  the  respondents  cited  a  policy  guiding  tasking  requirements, 
but  all  of  them  were  receptive  to  external  taskings.  One  response  indicated  any  ranking 
member  of  the  department  could  initiate  a  tasking,  another  stated  any  of  the  main 
stakeholders  could  do  so.  The  two  remaining  centers  stated  that  either  local  or  federal 
agencies  could  initiate  a  request. 

The  survey  data  also  found  that  100  percent  of  the  fusion  centers  felt  they  could 
“task”  the  emergency  responder  community  with  requests  for  information  in  the  form  of 
information  bulletins  advising  the  ER  community  to  be  alert  for  whatever  specific 
information  was  needed. 
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5.  How  do  they  disseminate  information  and  to  what  purpose? 

Two  of  the  five  fusion  centers  disseminate  between  25  and  50  percent  of  their 
product  at  the  Law  Enforcement  Sensitive  (LES)  level  and  a  third  fusion  center 
disseminated  50  to  75  percent  of  its  product  at  the  LES  level.  The  remaining  two  fusion 
centers  disseminated  between  10  and  25  percent  of  their  product  at  the  LES  level.  All 
five  of  the  fusion  centers  disseminated  less  than  10  percent  of  their  product  at  the  secret 
or  top  secret  level.  The  survey  also  revealed  that  three  of  the  five  fusion  centers 
disseminate  between  25  and  50  percent  of  their  product  at  the  FOUO  level  and  the 
remaining  two  fusion  centers  disseminate  between  50  and  75  percent  of  their  product  at 
the  FOUO  level. 

The  survey  indicated  that  FOUO  information  was  disseminated  40  percent  of  the 
time  by  e-mail  and  60  percent  of  the  time  by  a  secure  electronic  communication.  LES 
information  was  disseminated  in  the  same  manner.  Secret  and  top  secret  intelligence  was 
disseminated  80  percent  of  the  time  in  person  and  20  percent  the  time  by  “other.”  Sixty 
percent  of  the  fusion  centers  had  an  internal  method  to  disseminate  intelligence  to  field  or 
line  level  emergency  responders  and  60  percent  relied  on  liaisons  between  the  fusion 
center  and  the  line  personnel  to  disseminate  intelligence.  One  center  had  both  methods  of 
dissemination. 

6  How  do  the  fusion  centers  collect  information  from  their  emergency 
responder  community  and  are  those  processes  satisfactory?  Also,  what  are 
their  collection  methods  and  the  scope  of  their  collection  process? 

The  results  from  the  survey  show  that  four  out  of  five  of  the  fusion  centers  receive 
between  25  and  50  percent  of  their  source  data  from  local  agencies,  which  was  the  single 
largest  source  for  data  that  analysts  use  at  the  state  and  local  fusion  centers.  The  survey 
also  showed  that  two  of  the  five  fusion  centers  received  less  than  10  percent  of  their 
source  data  from  the  federal  government  and  four  out  of  five  fusion  centers  said  that  they 
received  less  than  10  percent  of  their  source  data  from  the  state  government.  This  survey 
clearly  indicates  not  only  the  value,  but  the  usefulness  of  local  data  as  a  source  of 
analysis  for  state  and  local  fusion  centers. 
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Of  the  local  data  sources  two  of  the  five  fusion  centers  identified  law  enforcement 
as  providing  between  50  and  75  percent  of  the  their  data  with  a  third  reporting  law 
enforcement  as  the  source  of  between  75  and  100  percent  of  the  source  data.  Terrorism 
Liaison  Officers  (TLO)  were  the  source  of  50  to  75  percent  of  local  data  for  two  fusion 
centers  and  between  75  and  100  percent  for  two  more.  Sixty  percent  of  the  fusion  centers 
reported  receiving  less  than  10  percent  of  their  local  data  from  fire  personnel,  and  two 
fusion  centers  reported  receiving  between  10  and  25  percent  of  their  data  from  the  fire 
service.  All  five  fusion  centers  reported  receiving  less  than  10  percent  (this  was  the 
lowest  rating  on  the  scale)  of  their  local  source  data  from  each  of  the  categories  of:  pubic 
health,  emergency  medical  services,  and  public  works. 

The  survey  also  reported  that  80  percent  of  the  fusion  centers  felt  that  the 
emergency  responder  community  is  not  being  appropriately  utilized  as  a  data  source. 
There  was  a  wide  range  of  variability  in  response  to  the  question:  Do  you  think  that,  as  a 
source,  the  line  level  emergency  responder  community  has  access  to  potentially  valuable 
information.  The  response  was:  one  fusion  center  reported  “sometimes,”  a  second 
reported,  “often”  a  third  reported  “usually,”  a  fourth  reported  “almost  always”  and  the 
fifth  reported  “always.”  This  range  may  represent  a  philosophical  approach  to  the  unused 
potential  of  the  ER  community  or  it  may  reflect  how  much  each  of  the  fusion  centers  uses 
the  ER  community  in  their  sphere  of  influence.  There  are  many  other  potential 
explanations  for  the  variance  but  the  data  is  insufficient  to  be  able  to  try  to  interpret  the 
variance  in  response.  Nonetheless,  80  percent  of  the  fusion  centers  felt  that  the 
emergency  responder  community  had  access  to  potentially  valuable  information  between 
“often”  and  “always.”  This  is  clearly  a  sufficient  intelligence  potential  in  the  emergency 
responder  community  for  the  fusion  centers  to  attempt  to  acquire  this  infonnation. 

The  surveys  point  to  a  perceived  lack  of  situational  awareness  by  the  ER 
community  as  a  problem.  Although  the  managers  of  the  fusion  centers  felt  that,  by  and 
large,  the  emergency  responder  community  had  access  to  potentially  valuable 
information  only  one  of  the  fusion  centers  reported  that  the  ER  community  “usually” 
knew  what  to  look  for.  Two  of  the  fusion  centers  felt  that  the  ER  community  “often” 
knew  what  to  look  for  and  another  two  others  felt  that  the  ER  community  only 
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“sometimes”  knew  what  to  look  for.  Three  of  the  five  fusion  centers  felt  that  they 
“usually”  had  appropriate  reporting  mechanisms  for  the  emergency  responder  community 
to  report  suspected  terrorist  activity.  The  remaining  two  fusion  centers  reported  that  they 
thought  the  emergency  responder  community  “sometimes”  and  “often”  had  appropriate 
reporting  mechanisms.  Sixty  percent  of  the  fusion  centers  thought  the  reporting 
mechanisms  were  either  “almost  always”  or  “always”  available  and  user  friendly  and  yet 
60  percent  of  the  fusion  centers  felt  that  the  emergency  responder  community  was  only 
“sometimes  “  taking  advantage  of  reporting  opportunities.  This  data  seems  to  suggest 
that,  according  to  the  respondents,  the  emergency  responder  community  generally  has 
access  to  useful  information,  has  appropriate  reporting  mechanisms  that  are  available  and 
user  friendly;  and,  yet  are  not  reporting  information  as  might  be  expected. 

A  frequently  cited  source  of  potential  data  is  community  oriented  policing  (COP). 
The  survey  results  state  quite  convincingly  that  this  is  currently  not  the  case.  Three  of  the 
five  fusion  centers  reported  that  they  get  less  than  5  percent  of  their  tips  or  leads  from 
COP.  The  fourth  fusion  center  reported  receiving  5  to  10  percent  of  their  tips  or  leads 
from  COP.  Three  of  four  respondents  reported  COP  as  an  under  utilized  resource  with 
one  center  skipping  the  question. 

One  hundred  percent  of  the  fusion  centers  felt  it  was  important  to  acknowledge 
the  emergency  responders  that  provide  tips  or  leads.  Two  of  the  centers  did  so  by  phone 
with  two  more  doing  so  by  e  mail.  One  center  made  the  acknowledgement  in  person. 
None  of  the  centers  had  an  automatic  acknowledgement  system  and  all  made  the  effort  on 
an  individual  basis  to  respond  to  the  tip. 

Results  from  the  survey  showed  that  all  of  the  fusion  centers  have  a  TLO  liaison 
with  law  enforcement  and  fire;  and,  80  percent  had  a  liaison  with  emergency  medical 
services  as  well  as  public  health.  Only  20  percent  of  the  fusion  centers  had  a  liaison  with 
public  works.  The  role  the  TLO  varies  according  to  which  discipline  and  emergency 
responder  community  that  the  TLO  is  interacting  with.  In  the  law-enforcement  discipline 
all  five  fusion  centers  reported  the  role  of  the  TLO  was  to  collect  information  and  to 
facilitate  the  program.  Three  out  of  five  fusion  centers  reported  educating  line  personnel 
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was  an  additional  role  for  law  enforcement  TLOs.  Two  of  the  five  fusion  centers 
reported  educating  administrators  and  investigating  tips  was  also  a  role  for  law 
enforcement  TLOs. 

Law  enforcement  and  fire  reported  to  have  the  biggest  roles  in  the  TLO  program. 
The  biggest  difference  being  that  fire  TLOs  provided  more  administrative  support  and 
law  enforcement  TLOs  were  reported  to  have  more  of  a  role  in  collecting  information  and 
providing  tips. 


Figure  3.  Role  of  the  TLOs.  (From  STTAC/RTTAC  survey) 


B.  SACRAMENTO  JOINT  POWERS  AUTHORITY  (JPA)  SURVEY 

Comparisons  between  fusion  centers  are  difficult  because  there  are  no 
standardized  definitions  for  the  types  of  analysts  and  what  their  product  is  or  should  be. 
Sacramento  received  a  grant  from  the  DHS  to  provide  fusion  analyst  training  on  a 
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nationwide  scale.  As  part  of  developing  curriculum,  the  Sacramento  Joint  Powers 
Authority,  responsible  for  the  program,  conducted  an  infonnal  phone  survey  of  fusion 
centers  across  the  country.  Thirty  six  fusion  centers  were  identified  as  operational;  of  the 
thirty  six,  twenty-one  agreed  to  participate  in  the  interview.  The  interviews  were 
conducted  by  phone  and  the  respondents’  answers  were  recorded  by  staff. 

One  of  the  questions  on  the  phone  survey  was:  How  are  your  fusion  center 
analysts  different  from  crime  analysts?  Of  the  twenty-one  responses,  five  stated  there 
was  little  or  no  difference,  twelve  described  their  analysts  function  as  tactical,  because 
they  also  conducted  counter  terrorism  support.  Only  four  gave  responses  that  may 
indicate  that  strategic  analysis  was  being  conducted.  Another  question  was:  What 
percentage  of  your  analysts’  time  is  spent  on  terrorist  threat  analysis?  Eleven  fusion 
centers  responded  low  or  very  low  with  given  percentages  ranging  from  10  to  30  percent. 
Some  respondents  did  not  give  an  approximate  percentage  and  identified  the  level  of 
threat  assessment  activity  as  minimal  or  very  low.  Five  fusion  centers  gave  a  mid-range 
level  of  time  spent  on  threat  assessments,  rating  themselves  as  being  between  50  and  70 
percent.  Four  fusion  centers  rated  their  percentage  of  terrorist  threat  assessment  as  high 
or  very  high,  between  80  and  100  percent.48 

In  the  informal  survey  conducted  by  the  Sacramento  Joint  Powers  Authority,  the 
twenty-one  fusion  centers  that  responded  to  the  survey  identified  analytical  skills  and 
writing  skills  as  the  area  where  their  analysts  needed  the  most  improvement.  Eighteen  of 
the  twenty-one  centers  stated  that  their  analysts  had  received  some  training  in  analytical 
thinking  and  analytical  tools.  Training  identified  as  most  needed  included  analytical 
skills,  terrorism  fundamentals,  and  report  and  analytical  writing.  Other  identified  training 
needs  were:  identifying  reportable  intelligence,  intelligence  methodologies,  open  source 
exploitation,  anticipating  law  enforcement  needs,  advanced  research  skills,  and  analytic 
tools.49 


48  Sacramento  Joint  Powers  Authority,  Fusion  Center  Intelligence  Analyst  Job  Task  Analysis  and 
Training  Needs  Assessment,  July  27-August  1,  2007. 

49  Sacramento  Joint  Powers  Authority. 
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c. 


SUMMARY  OF  THE  CALIFORNIA  FUSION  CENTERS  SURVEY 


•  Law  enforcement  and  investigators  are  the  primary  customers  of  fusion 
centers  as  identified  by  fusion  center  commanders 

•  Policy  makers  are  secondary  customers  of  fusion  centers 

•  A  modest  majority  of  the  fusion  centers  have  an  all  crime  perspective 

•  Of  the  fusion  centers  that  do  have  an  all  crime  orientation  the  crimes  most 
often  targeted  are  financial  crime  and  gang  activity 

•  Half  of  the  reporting  fusion  centers  stated  their  value  to  consumers  would 
be  diminished  if  they  did  not  include  an  all  crime  perspective 

•  Most  of  the  fusion  centers  (60  percent)  have  a  strategic  and  a  tactical 
capability 

•  The  fusion  centers  are  receptive  to  taking  tasking  requests  from  almost 
anyone  in  authority 

•  A  significant  amount  of  intelligence  product  is  disseminated  at  the  LES 
level 

•  The  majority  of  intelligence  product  is  disseminated  at  the  FOUO  level 

•  Local  agencies  were  the  single  largest  source  of  data  for  the  fusion  centers 

•  Law  enforcement  and  TLOs  provided  the  majority  of  local  source  data 

•  The  vast  majority  of  the  fusion  centers  felt  that  the  emergency  responder 
community  was  not  being  appropriately  utilized  as  a  data  source 

•  Situational  awareness  seems  to  be  lacking  in  the  emergency  responder 
community 

•  Community-oriented  policing  is  largely  ineffective  in  providing 
information  to  the  fusion  centers 

•  The  vast  majority  of  fusion  centers  felt  COP  was  under-utilized  as  a 
potential  data  source 
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•  All  of  the  fusion  centers  have  a  TLO  liaison  with  both  law  and  fire 

•  Law  TLOs  provided  more  tips  and  information  collection  than  did  fire 
TLOs 

•  Fire  TLOs  provide  more  administrative  support  and  line  level  education  to 
their  agency  than  law  TLOs 

D.  SUMMARY  OF  THE  SACRAMENTO  JOINT  POWERS  AUTHORITY 

(JPA)  SURVEY 

•  Of  the  twenty  one  responses  on  the  national  survey,  only  four  gave 
responses  that  gave  an  indication  of  conducting  strategic  analysis  in  their 
fusion  centers 

•  Half  of  the  fusion  centers  spent  little  or  very  little  of  their  time  on  terrorist 
threat  analysis 

•  Almost  90  percent  of  the  fusion  center  analysts  had  received  some 
training  in  analytic  thinking  and  analytic  tools 

•  Training  that  the  fusion  centers  identified  as  most  needed  was  analytical 
skills,  terrorism  fundamentals,  report  and  analytical  writing 
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III.  ANALYSIS  OF  CURRENT  PRACTICE  FOR  FUSION 

CENTERS 


Prevention  is  the  first  of  the  four  goals  of  the  National  Strategy  for  Homeland 
Security.50  It  can  be  argued  that  fusion  centers  provide  an  excellent  opportunity  to 
provide  that  prevention.  This  thesis  will  not  attempt  to  justify  or  validate  the 
effectiveness  or  usefulness  of  fusion  centers.  The  performance  measures  and  metrics  for 
such  an  assessment  are  lacking  and  will  be  left  to  future  studies.  While  this  thesis  will 
not  measure  the  effectiveness  of  the  fusion  centers,  it  remains  critically  important  that 
fusion  centers  are,  or  become,  effective.  This  thesis  accepts  the  fact  that  significant 
resources,  both  in  money  and  personnel,  have  been  dedicated  to  fusion  centers.  This 
thesis  will  focus  on  what  practices  may  provide  the  greatest  value  for  the  jurisdictions 
that  support  them  and  thereby  improve  their  potential  usefulness  for  future  assessments. 

Fusion  centers  evolved  because  of  a  perceived  need  at  the  local  level.  This  need 
must  be  met  if  fusion  centers  are  to  become,  or  remain,  viable.  In  testimony  before 
Congress,  Norman  Beasley,  Counterterrorism  Coordinator  for  Arizona,  spoke  in 
reference  to  fusion  centers: 

Their  ultimate  goal  is  to  support  their  consumers  with  beneficial 
information.  But,  the  consumers  also  have  a  critical  role  in  the  production 
of  information  and  ultimately  intelligence.51 

The  “consumers”  Norm  Beasley  is  referring  to  are  the  local  policymakers  and 
emergency  responder  community. 

A.  MANAGEMENT  OF  THE  FUSION  CENTER 

For  the  fusion  centers  to  run  efficiently  and  effectively,  they  will  need  to  have  a 
clear  mission,  internal  organization,  a  strategic  purpose,  and  adequate  resources  to  fulfill 
their  duties.  If  fusion  centers  are  to  be  effective  and  relevant  at  the  local  level,  they  need 

50  National  Strategy’  for  Homeland  Security,  Homeland  Security  Council,  October  2007,  1. 

51  Beasley,  Testimony  before  the  U.S.  House  of  Representatives. 
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to  meet  the  needs  of  the  local  ER  community.  To  do  this,  they  must  produce  timely, 
relevant,  locally  actionable  intelligence  that  can  be  used  either  by  local  policymakers  for 
situational  awareness,  resource  deployment  or  protection  efforts,  or  for  investigation  or 
preemption  at  a  local  level. 

1.  Mission 

To  meet  the  most  basic  of  concepts  for  a  fusion  center,  developing  a  mission 
statement,  the  center  must  identify  who  their  customers  are  and  what  products  they  want. 
As  stated  in  the  Fusion  Center  Guidelines,  guideline  number  two,  fusion  centers  should 
develop  a  mission  statement  via  a  collaborative  process.52  The  guidelines  also  state  that 
the  governance  board  should  define  a  management  structure  to  include  what  entity  will 
oversee  the  center’s  operations  and  daily  activities.  There  is  no  recommendation  on  how 
that  should  be  accomplished;  instead,  it  is  left  up  to  the  individual  fusion  centers  to 
develop  a  system  that  works  best  for  them. 

The  nature,  role,  staffing  and  mission  of  state  and  local  fusion  centers  varies 
widely  throughout  the  nation  and  even  from  center  to  center  in  California.  Jerry 
Murphy,  director  of  homeland  security  issues  for  the  Police  Executive  Research  Forum 
(PERF),  is  undertaking  a  national  study  of  fusion  centers  for  DHS.  He  notes  that  the  goal 
of  DHS  is  not  to  create  cookie-cutter  molds  for  fusion  centers,  but  to  respond  to  the  local 
needs.  Trying  to  figure  out  what  is  the  best  model  —  and  what  are  the  appropriate 
divisions  of  labor  for  local  agencies  in  the  investigation  of  the  crime  of  terrorism  —  is  a 
complex  issue.  Murphy  makes  the  observation  that  the  FBI  clearly  has  the  lead  in  any 
terrorist  investigation;  establishing  the  role  of  state  and  local  government  in  the 
counterterrorism  world  will  determine,  to  a  large  extent,  what  happens  in  a  local  fusion 
center.  He  believes  the  future  of  fusion  centers  may  be  a  movement  away  from  the  true 
intelligence  community  interpretation  for  a  fusion  center  to  one  that  is  more  relevant 
locally.  What  is  the  payback  for  local  law  enforcement  for  their  commitment  of  time  and 


52  Fusion  Center  Guidelines,  23. 
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resources?53  The  mission  of  any  fusion  center  needs  to  identify  its  role  and  its  customer, 
and  to  produce  a  product  of  value  to  be  sustainable. 

Norm  Beasley  describes  the  process  of  refining  one’s  mission  into  written  form  as 
a  critical  step,  delineating  the  roles  and  responsibilities  of  everyone  associated  with  the 
fusion  center.  A  written  mission  statement  or  a  concept  of  operations  lets  your  customers 
know  who  you  are  and  what  you  do,  as  well  as  those  who  may  be  concerned  about  the 
abuse  of  civil  rights.  A  written  code  of  conduct  and  method  of  operations  will  provide 
guidance  and  protections.  Having  a  documented  operating  procedure  will  help  protect 
the  organization  from  challenges  of  excess.54 

The  STTAC  and  the  four  RTTACs  collaborated  on  a  concept  of  operations  plan 
as  a  guiding  principle  for  all  five  of  the  threat  assessment  centers  that  also  function  as 
fusion  centers.  As  part  of  that  concept  of  operations,  a  mission  statement  and  a  vision 
statement  is  included.  The  mission  statement  is: 

The  mission  of  the  state  terrorism  threat  assessment  system  is  to  foster  a 
collaborative  effort  to  collect  and  analyze  criminal  infonnation,  employ 
cutting-edge  analytical  tools  and  methodologies  to  produce  and  share 
timely  and  actionable  Homeland  Security  intelligence,  thereby  enhancing 
the  safety  of  the  citizens  of  California.55 

For  any  fusion  center  to  function  in  a  coherent,  let  alone  efficient,  manner,  it  must 
have  a  mission  that  is  a  collaborative  derivative  of  the  governance  board  and  the  senior 
members  of  the  fusion  center.  That  mission  will  have  to  be  more  than  a  platitude  on  page 
two  of  some  document  that  no  one  reads.  The  mission  will  have  to  be  conveyed  and 


53  Jerry  Murphy,  Police  Executive  Research  Fomm,  Director  of  Homeland  Security,  Interview, 
December  17,  2007.  1. 

54  Beasley,  Maricopa  County  Sheriff  s  Department,  Counter  Terrorist  Coordinator,  Former  Arizona 
Department  of  Public  Safety,  Director  of  Arizona  Counter  Terrorism  Information  Center,  (Ret.),  the 
development  of  mission  statements  and  concept  of  operations  plans  is  one  of  the  tasks  that  Mr.  Beasley 
performs  in  his  role  as  technical  advisor  for  DHS,  December  3,  2007. 

55  Strategic  Business  Plan  Concept  of  Operations,  California  State  Terrorism  Threat  Assessment 
System,  nd,  3. 
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reinforced  in  deed  and  action.  The  question  becomes  whose  mission  statement  gets 
adopted  and  to  what  purpose.  To  answer  that  question,  one  must  identify  “who”  is  the 
customer  or  customers  of  the  fusion  center. 

a.  Customer  Identification 

In  the  survey  conducted  with  the  four  RTTACs  and  the  STTAC,  the  fusion 
centers  overwhelmingly  identified  investigators  and  law-enforcement  as  their  primary 
customer.  However,  the  question  remains:  Does  this  fit  in  with  their  mission  statement? 
Congruence  between  mission  statement,  customer  identification,  and  product  output  is 
critical  to  the  usefulness  and  cohesion  of  a  fusion  center,  and  will  promote  sustainability. 
If  the  majority  of  the  fusion  center's  customer  base  is  law  enforcement,  what  products  are 
being  produced  for  them  to  consume?  If  one  considers  law  enforcement  a  primary 
customer,  are  there  sub-customer  groups  within  that  category?  One  could  logically  argue 
that  law  enforcement  administrators  are  customers,  as  well  as  rank-and-file  law 
enforcement  officers,  and  investigators  could  be  a  third  set  of  customers  within  the  law 
enforcement  domain.  Fusion  centers  have  many  other  customers  to  consider  besides  law 
enforcement,  such  as  policy  makers,  fire,  EMS,  etc. 

A  lack  of  organizational  customer  identification  will  often  translate 
throughout  the  fusion  center  with  the  result  that  product  delivery  may  be  accurate  but  it 
may  also  be  erratic  and  inconsistent.  During  a  recent  training  seminar  in  Monterey, 
sponsored  by  the  STTAC  for  the  RTTAC  and  STTAC  analysts,  there  was  a  definite  lack 
of  clarity  amongst  the  analysts  as  to  who  their  customers  were.  There  was  very  little 
consensus  of  who  was  the  customer  and  what  the  customer  wanted  in  the  way  of  a 
product.  The  analysts  had  received  very  little  feedback  that  could  guide  their 
requirements.  This  lack  of  clarity,  by  the  analysts  who  write  the  product,  can  only  have  a 
negative  impact  on  the  usefulness  and  assimilation  of  their  written  product.56 

This  lack  of  customer  identification,  by  a  large  segment  of  the  analyst 
pool,  supports  the  absolute  need  to  identify,  specifically,  who  the  customer  is  for  what 

56  Analyst  Training  Seminar,  Monterey,  California,  Sponsored  by  the  California  State  Terrorism 
Threat  Assessment  Center,  January  23,  2008,  personal  observation. 
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intelligence  product.  It  may  well  be  that  there  can  be  multiple  customers.  For  example, 
executives  and  elected  officials  may  be  customers  for  strategic  threat  assessments  and 
situational  awareness;  JTTF  task  force  members  could  be  customers  for  terrorism 
investigative  case  support;  and  criminal  investigators  or  law  enforcement  officers  could 
be  customers  for  major  criminal  case  support. 

In  addition  to  identifying  all  of  your  customers,  one  must  consider  at  what 
level  they  will  consume.  What  level  of  detail  or  how  much  information  is  required  for 
each  customer?  Do  you  have  consumers  that  want  to  consume  your  product,  do  they 
consume  it,  or  are  they  more  interested  in  crime  trends  rather  than  emerging  threats  in  the 
Middle  East  that  may  or  may  not  arrive  in  their  back  yard?.  In  addition  to  identifying 
your  customers,  fusion  centers  need  to  identify  what  consumers  want  in  a  product,  and 
balance  that  with  other  obligations  of  the  fusion  center.57 

Local  fusion  centers  need  to  assume  the  responsibility  to  reach  out  to  local 
administrators  to  find  out  precisely  what  information  or  intelligence  products  are  desired. 
Norm  Beasley  makes  the  point  that  it  is  paramount  to  a  fusion  centers’  success  to 
discover  that  need  and  provide  it.  He  also  makes  the  point  that  the  local  administrators 
and  consumers  have  an  absolute  responsibility  to  tell  the  fusion  centers  what  they  want 
and,  just  as  importantly,  what  they  do  not  want.58  Will  a  local  chief  of  police  read  a 
twenty-five-page  brief  on  gangs? 

The  interviews  generally  seem  to  bear  out  the  finding  of  the  survey,  which 
identified  law  enforcement  and  investigators  as  the  primary  customer  of  the  fusion 
centers.  In  an  interview  with  Roseville  Fire  Chief  Ken  Wagner,  he  stated  that  he  felt  that 
the  fusion  centers  were  primarily  a  law  enforcement  tool,  but  that  they  did  have  a  definite 
capability  for  the  fire  department.  He  added  that  he  relied  on  the  fusion  center  to  provide 
him  with  the  information  that  he  needed  as  an  administrator  for  situational  awareness. 
He  also  relied  on  his  battalion  chief,  assigned  to  the  Sacramento  Regional  Office  of 


57  Phil  Bodenhorn,  Supervisor,  Sacramento  FBI  Field  Investigative  Group,  December  5,  1007. 

58  Beasley,  interview. 
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Homeland  Security,  to  relay  information  that  was  relevant  to  the  firefighters  for  either 
their  safety  or  as  a  tasking  requirement  in  the  form  of  a  request  for  information.59 

Law  enforcement  administrators  did  feel  that  LE  should  be  the  primary 
focus,  but  noted  that  they  would  like  to  see  more  emphasis  on  major  crimes  and  better 
situational  awareness  for  administrators.  Sacramento  Chief  of  Police  Rick  Braziel 
observed  that  fusion  centers  are  most  effective  when  they  engage  the  law  enforcement 
community  more  in  a  preventive  posture  —  and  not  just  for  counterterrorism,  but  for 
major  crimes.  As  an  example  of  a  requirement,  he  would  propose  addressing  regional 
crime  issues,  such  as  gangs,  regionally,  rather  than  pushing  it  back  and  forth  across  a 
jurisdictional  boundary.60  This  sentiment  was  echoed  by  Sacramento  County  Sheriff 
McGinness  who  took  the  position  that  the  fusion  center  mission  could  include  anything 
that  would  make  the  community,  or  officers  working  in  the  community,  safer.61 

Care  must  be  taken  to  ensure  that  there  is  congruency  between  who  the 
fusion  center  believes  its  customer  to  be  and  who  the  governing  board  believes  the 
customer  should  be.  An  involved  and  active  governance  board  should  be  aware  of  the 
standing  requirements  and  the  identification  of  the  primary  and  secondary  customers  of 
the  fusion  center,  and  ensure  that  those  needs  are  being  met.  In  the  event  of  a  conflict, 
skillful  leadership  with  a  collaborative  and  network-oriented  approach  will  be  required  to 
reach  a  compromise  amongst  the  varying  jurisdictions  and  disciplines.  The  regional 
partners  in  the  governance  board  must  be  able  to  set  the  requirements,  or  the  objectives, 
of  the  fusion  center. 

b.  Tasking 

A  clear  and  definitive  set  of  standing  tasking  requirements,  along  with 
clear  identification  of  who  the  customer  is  for  those  particular  tasking  requirements,  will 
add  to  the  quality  and  ultimate  usefulness  of  the  end  product.  This  was  an  issue 
discussed  in  the  recent  analyst  training  in  Monterey,  and  was  an  issue  that  was 

59  Ken  Wagner,  Roseville  California  Fire  Chief,  interview,  November  21,  2007. 

60  Rick  Braziel,  Sacramento  Chief  of  Police,  interview,  December  4,  2007. 

61  John  McGinness,  Sacramento  County  Sheriff,  interview,  December  19,  2007. 
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widespread  throughout  the  ranks  of  the  analysts  represented  at  the  training.62  One  of  the 
biggest  problems  facing  fusion  centers  is  getting  law  enforcement  administrators  to 
establish  standing  requirements.  Law  enforcement  administrators  cannot  become 
efficient  consumers  of  intelligence  if  they  do  not  take  an  active  part  in  establishing  what 
requirements  are  established  or  why.  The  standing  requirements  of  a  fusion  center  should 
not  be  established  in  an  ad  hoc  fashion.63  For  the  fusion  centers  to  have  value  to  the  ER 
community  the  ER  administrators  should  have  input  as  to  the  priorities  of  what  product  is 
produced.  ER  administrators  will  have  to  be  educated  on  the  intelligence  process  and 
how  to  become  effective  consumers  of  intelligence. 

The  LA  RTTAC  does  not  have  a  written  standing  tasking  requirement, 
partly  due  to  the  co-management  of  the  organization  between  LASO,  LAPD  and  the  FBI. 
Tasking  is  done  by  the  manger  on  duty  as  the  need  of  the  situation  presents  itself.64  The 
tasking  assignments  to  analysts  in  the  Northern  California  RTTAC  and  the  Sacramento 
RTTAC  are  done  by  the  supervisors. 

Just  as  the  regional  partners  can  task  the  fusion  center  by  establishing  the 
appropriate  standing  requirements  for  the  fusion  center,  the  fusion  center  must  be  able  to 
task  the  ER  community  for  new,  additional,  or  supplemental  infonnation.  A  robust 
mechanism  for  this  tasking  must  be  established.  The  survey  data  found  this  to  be  the 
case. 

All  of  the  fusion  centers  were  flexible  in  who  could  task  the  center  with  a 
request  for  an  intelligence  product;  anyone  with  an  administrative  association  would  be 
able  to  make  such  a  request.  This  collaborative  approach  is  salutary.  An  unanswered 
question  is  who  takes  advantage  of  this  capability,  and  how  often. 

An  additional  point  on  tasking  is  made  by  Norm  Beasley.  He  suggests 
that,  in  addition  to  having  local  administrators  assist  in  establishing  standing 

62  Analyst  Training  Seminar,  Monterey,  California. 

63  Personal  communication  with  a  confidential  source  who  is  a  career  intelligence  analyst,  February 
22,  2008. 

64  Robert  Galarneau,  Lieutenant,  Los  Angeles  County  Sheriff  s  Department,  Co-Manager  of  the  LA 
Regional  Terrorism  Threat  Assessment  Center,  interview,  December  14,  2007. 
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requirements  for  state  and  local  fusion  centers,  a  national  network  of  fusion  centers 
should  be  established  with  federal  guidelines  on  standing  requirements  from  the  federal 
government  to  the  state  and  local  fusion  centers.  This  is  not  a  task  the  government  will 
be  anxious  to  do  as  it  may  give  the  appearance  of  trying  to  take  over  the  local  fusion 
centers.  But  a  network  is  just  that,  an  exchange  of  information  with  two-way  tasking  at 
all  levels.  Local  centers  could  task  the  federal  government  for  intelligence  gaps  on  local 
threat  activity  and  the  federal  agencies  could  task  the  locals  with  their  greater  number  of 
assets  and  community  contacts.  This  will  be  a  rather  delicate  undertaking  but  nonetheless 
a  worthwhile  one.65 

Finally,  once  the  mission  and  customer  identification  has  occurred,  the 
center  will  need  to  determine  at  what  level  each  customer  will  be  supported.  Is  the 
primary  mission  of  the  center  to  support  counterterrorist  efforts,  criminal  case  support,  or 
situational  awareness?  Most  will  have  all  three  and  an  equitable  (based  on  identified 
need)  distribution  of  resources  and  product  will  go  a  long  way  to  crystallizing  the 
mission,  meeting  expectations  and  gaining  customer  satisfaction. 

To  accomplish  this,  the  fusion  centers  will  be  required  to  develop  a 
method  of  prioritization  for  resource  allocation,  which  should  be  based  on  the  local  threat 
picture.  This  concept  is  supported  by  the  Fusion  Center  Guidelines,  guideline  number 
two,66  which  calls  for  a  prioritization  of  intelligence  functions  to  address  local  threats. 
This  point  is  central  to  one  of  the  major  themes  of  this  thesis,  which  is  intelligence 
products  that  are  produced  by  the  local  fusion  centers  must  not  only  be  timely,  but  must 
be  locally  actionable  if  they  are  to  provide  the  preventive  value  that  should  be  expected 
of  fusion  centers. 

2.  Philosophy 

How  fusion  center  professionals  approach  their  job  and  how  the  decisions  are 
made  about  the  operational  functions  of  the  fusion  center  are  perhaps  just  as  important  as 
what  those  operational  functions  become.  If  partners  are  made  to  feel  excluded  or 

65  Beasley,  interview. 

66  Fusion  Center  Guidelines,  23. 
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denigrated,  cooperation  and  collaboration  will  be  relegated  to  catch  phrases,  and  the 
potential  benefits  of  true  collaboration  and  networking  will  be  lost.  It  is  important  that 
leaders  in  fusion  centers  have  an  understanding  and  embrace  a  collaborative  and  inclusive 
environment  when  making  decisions  on  standing  requirements  and  the  operational 
posture  of  the  fusion  center.  To  do  that,  fusion  center  leaders  need  to  come  to  an 
agreement  on  what  the  basic  operating  principles  of  the  center  are  and  how  they  will  be 
addressed.  Among  issues  that  should  be  considered  are  the  value  of  prevention,  risk 
management,  what  is  the  local  threat,  strategic  vs.  tactical  support,  all  crimes  vs.  strictly 
counterterrorist  perspective,  prioritization,  and  standing  tasking  requirements. 

a.  Prevention 

The  threat  of  a  terrorist  attack  has  dramatically  shifted  the  focus  of  local 
law  enforcement.  Much  has  been  written  about  the  need  for  local  law  enforcement  to 
take  an  active  role  in  not  only  preparing  to  respond  to  an  attack,  but  more  importantly, 
being  a  major  player  in  preventing  an  attack.  This  is  a  new  role  for  domestic  law 
enforcement  and  the  major  sticking  point  is  how  best  to  accomplish  this  obvious  but 
elusive  goal. 

Almost  every  jurisdiction  that  chooses  to  address  the  issue  (and  not  all 
do),  has  a  different  approach  with  varying  degrees  of  success.  One  comes  up  against  the 
requiem:  How  do  you  measure  what  has  not  happened?  The  Director  of  the  California 
State  Office  of  Homeland  Security,  Matt  Bettenhausen,  illustrates  this  problem  stating, 
“The  more  successful  you  are,  the  less  you  have  to  show  for  it.”  He  adds  that 
“prevention  is  our  first  goal,  and  prosecution  comes  next.  If  prosecution  were  our  first 
priority,  it  would  be  better  to  allow  some  of  these  groups  to  develop  more,  but  the  stakes 
are  too  high.”67 

The  range  of  operational  responses  varies  dramatically  from  state  to  state 
and  from  jurisdiction  to  jurisdiction.  Some  jurisdictions  (or  administrators)  feel  that  “it 
won't  happen  to  us”  and  put  very  little  effort  into  prevention.  Instead,  they  focus  much  of 


67  Bettenhausen,  interview. 


45 


their  homeland  security  resources  into  a  response  capability,  which  they  may  be  able  to 
use  in  events  other  than  a  domestic  terror  attack.  However,  a  significant  number  of 
jurisdictions  are  beginning  to  recognize  the  value  of  prevention  over  that  of  response, 
realizing  that  if  we  need  to  respond  to  a  domestic  terrorist  attack  we  have,  to  a  certain 
extent,  already  lost. 

If  fusion  centers  are  to  be  seen  as  valuable  enterprises,  worthy  of  their 
funding  and  resource  expenditure,  the  governance  board  and  the  management  of  the 
fusion  centers  must  adopt  a  philosophical  acceptance  that  prevention  is  key  to  homeland 
security,  and  be  able  to  convey  that  message  to  the  local  political  and  administrative 
leadership.  The  shift  of  identifying  homeland  security  protection  from  response 
equipment  procurement  to  intelligence-inspired  prevention  is  one  that  will  require 
support  and  evidence.  Homeland  security  dollars  are  moving  away  from  response  and 
into  prevention.  There  are  constituent  groups  that  will  be  resistant  to  this  shift.  For  some 
years,  response  capacity  has  been  the  major  benefactor  of  grant  dollars  with  the  purchase 
of  costly  response  equipment.  Many  local  administrators  will  be  loathe  to  give  up  their 
big-ticket  equipment  items,  previously  paid  for  by  grants  in  exchange  for  information  or 
intelligence  that  may  or  may  not  prevent  an  attack  that  may  or  may  not  happen. 

Fusion  center  advocates  will  need  to  demonstrate  that  intelligence,  tailored 
to  the  sphere  of  influence  of  each  individual  fusion  center,  is  an  approach  that  can 
provide  protection  for  the  homeland  if  fusion  centers  are  to  gain  acceptance  from  the 
local  emergency  responder  community,  and  more  importantly,  their  administrators.  To 
this  end,  fusion  centers  may  well  need  to  include  threats  other  than  terrorists. 

The  CRS  report  reinforces  the  point  that  fusion  centers  can  enhance 
protection  with  the  observation:  “Creating  a  fusion  center  is  a  tangible  action  that  seeks  to 
enhance  state  and/or  regional  coordination  and  cooperation  to  prevent  and  mitigate,  and 
in  some  cases,  respond  and  recover  from  homeland  security  threats.”  The  report 
continues  the  argument  for  a  common  adoption  of  the  prevention  philosophy  stating, 

If  fusion  center  constituent  agencies  don’t  buy  into  a  common  fusion  and 
prevention  philosophy  that  arguably  needs  to  accompany  fusion  centers 
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(i.e.,  responsibility  for  security,  a  proactive  approach,  and  need  for 
understanding  their  environment  to  discern  potential  threats),  can  fusion 
centers  be  effective?68 

An  educational  marketing  campaign  on  the  value  of  prevention  and  the 
potential  of  the  fusion  center  to  promote  that  prevention  should  be  a  combined  message, 
presented  by  an  influential  coalition. 

A  final  point  that  will  undoubtedly  generate  controversy:  What  is  the  risk 
management  strategy  that  will  be  supported  by  the  fusion  center?  Should  the  standing 
requirements  of  the  fusion  center  give  priority  to  the  less  likely  but  potentially 
devastating  WMD  attack,  or  should  the  more  likely,  less  catastrophic  conventional  attack 
with  perhaps  a  VBIED,  be  the  priority  of  the  fusion  center?  These  issues  will  not  be 
answered  in  this  thesis.  For  the  efficient  operation  of  fusion  centers,  however,  they  will 
need  to  be  addressed  by  the  governance  board,  emergency  responder  senior  executives 
and  elected  officials.  Brian  Jenkins  weighs  in  on  this  point  in  his  testimony  before 
Congress,  stating, 

allocation  of  resources  must  be  based  upon  assessments  of  risk  —  we  are 
moving  in  this  direction.  The  choice  lies  between  focusing  on  the  most 
likely  events  in  the  lower  registers  of  violence  or  on  the  less  likely  events 
that  would  have  the  greatest  consequences.69 


b.  Establish  a  Local  Threat 

In  order  to  form  a  cohesive  prevention  posture,  adopted  by  administrators 
and  line  personnel,  the  fusion  centers  will  have  to  identify  what  it  is  that  they  are  trying  to 
prevent;  identifying  a  local  threat  will  aid  in  this  effort.  The  National  Intelligence 
Estimate:  The  Terrorist  Threat  to  the  U.S.  Homeland,  released  in  July  2007,  states: 

We  assess  that  the  spread  of  radical  —  especially  Salafi  —  Internet  sites, 
increasingly  aggressive  anti-U.S.  rhetoric  and  actions,  and  the  growing 


68  Masse  et  al.,  CRS  Report  for  Congress,  10. 

69  Jenkins,  testimony  before  the  committee  on  appropriations  subcommittee  on  Homeland  security 
United  States  House  of  Representatives,  January  30,  2007;  this  paragraph  is  a  paraphrase  or  string  of  quotes 
of  Jenkins's  testimony,  2-4. 
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number  of  radical,  self-generating  cells  in  Western  countries  indicate  that 
the  radical  and  violent  segment  of  the  West's  Muslim  population  is 
expanding,  including  in  the  United  States.70 

The  estimate  goes  on  to  say  that: 

We  assess  that  globalization  trends  and  recent  technological  advances  will 
continue  to  enable  even  small  numbers  of  alienated  people  to  find  and 
connect  with  one  another,  justify  and  intensify  their  anger,  and  mobilize 
resources  to  attack — all  without  requiring  a  centralized  terrorist 
organization,  training  camp,  or  leader. 


The  ability  to  detect  broader  and  more  diverse  terrorist  plotting  in  this 
environment  will  challenge  current  U.S.  defensive  efforts  and  the  tools  we 
use  to  detect  and  disrupt  plots.  It  will  also  require  greater  understanding  of 
how  suspect  activities  at  the  local  level  relate  to  strategic  threat 
information  and  how  best  to  identify  indicators  of  terrorist  activity  in  the 
midst  of  legitimate  interactions.71 

The  2008  Annual  Threat  Assessment  from  the  Director  of  National 
Intelligence  reiterates  the  threat  potential  on  our  domestic  front: 

While  the  threat  from  such  homegrown  extremists  is  greater  in  Europe,  the 
U.S.  is  not  immune.  The  threat  here  is  likely  to  be  fueled  in  part  by 
propaganda  and  mischaracterizations  of  U.S.  foreign  policy  as  harmful  to 
Muslims,  rather  than  by  any  formal  assistance  from  al-Qa’ida  or  other 
recognized  groups.  The  al-Qa’ida-propagated  narrative  of  an  “us  versus 
them”  struggle  serves  both  as  a  platfonn  and  a  potential  catalyst  for 
radicalization  of  Muslims  alienated  from  the  mainstream  U.S. 
population.72 

Given  the  uncertainty  of  the  environment  —  and  the  relative  ease  of 
operation  with  which  disaffected  and  hostile  individuals  can  anonymously  engage  with 
and  reinforce  one  another  —  it  is  impossible  to  detennine,  with  any  degree  of  certainty, 


70  National  Intelligence  Estimate,  the  Terrorist  Threat  to  the  U.S.  Homeland,  Office  of  the  Director  of 
national  intelligence,  http://dni.gov/press  releases/20070717  release.pdf.  Last  accessed  January  17,  2008. 

71  Ibid. 

72  Michael  J.  McConnell.  Director  of  National  Intelligence,  Annual  Threat  Assessment  of  the 
Intelligence  Community  for  the  House  Permanent  Select  Committee  on  Intelligence,  February  5,  2008,  9. 
http://www.tsa.gov/assets/pdf/020520Q8  dni  testimony.pdf.  Last  accessed,  February  26,  2008. 
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the  extent  of  our  threat  in  any  locale.  To  illustrate  the  point,  consider  the  jihadist  terrorist 
cell  uncovered  in  June  2005  in  the  rural  farming  community  of  Lodi,  California.  The 
discovery  resulted  in  one  conviction  for  providing  material  support  for  terrorism,  a 
twenty-four-year  prison  sentence  and  the  deportation  of  two  local  Imams.  Prior  to  the 
discovery  of  the  cell,  few  people  would  have  chosen  Lodi  as  the  location  of  an  emerging 
jihadist  terrorist  cell.  The  potential  for  these  cells  and  other  domestic  single-issue 
terrorist  groups  to  spring  forth  without  warning  is  a  byproduct  of  our  technological  and 
interconnected  world. 

Among  the  countervailing  points  of  view  is  the  notion  that  the  domestic 
terrorist  threat  is  not  as  dire  or  imminent  as  we  have  been  led  to  believe.  Proponents  of 
this  argument  believe  that  the  United  States  will  be  able  to  absorb  any  such  attack  in 
stride.  A  lack  of  successful  jihadist  terrorist  attacks  in  the  intervening  years  since  9/11  is 
frequently  cited  as  evidence  for  the  position.  This  is  a  compelling  argument,  although 
several  attempts  throughout  the  country  have  been  disrupted  before  the  terrorists  could 
implement  their  attacks.  Those  arguing  the  position  that  the  domestic  threat  is  not 
significant  will  point  out  that  these  attempts  were  so  ill-formed  that  they  were  never  able 
to  be  initiated. 

Director  Bettenhausen  gives  context  to  this  argument  during  his  interview. 
His  position  was  that  many  of  the  domestic  plots  that  have  been  uncovered  nationwide 
were  unsophisticated,  and  considered  to  have  minimal  potential  by  some.  Who  would 
have  thought,  however,  that  nineteen  guys  with  box  cutters  could  have  done  what  they 
did  prior  to  9/11?  Much  of  our  success  is  due  to  interdicting  potential  threats  at  the 
lowest  level  of  discovery.  We  do  not  allow  the  enterprise  to  grow;  our  best  course  of 
action  may  be  deportation  or  exposure.73 

The  mere  threat  of  becoming  a  victim  of  a  terrorist  attack  can  have  a 
severe  impact  on  a  community,  including  the  mental-health  of  its  residents  and  the  way 
they  conduct  their  daily  lives.  As  an  example,  consider  the  DC  sniper  attacks  and  how 
they  affected  that  community.  These  were  two  unsophisticated  and  unsupported  lone 

73  Bettenhausen,  interview. 
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wolf  criminals  —  not  ideologically  motivated  terrorists,  pursuing  what  they  believed  to 
be  a  just  cause.  A  few  such  individuals  could  easily  wreak  that  level  of  havoc  on  any 
community  in  our  country.  It  is  not  unreasonable  to  believe  that  a  small  group  of 
dedicated  and  motivated  terrorists  could,  while  not  significantly  disrupting  the 
infrastructure  of  this  country,  have  a  significant  impact  on  the  national  psychology  and 
economy. 

It  is  a  reasonable  perception  that  a  police  officer  or  firelighter  is  unlikely 
to  uncover  a  planned  transnational  terrorist  plot  or  encounter  and  document  a  contact 
with  one  of  its  cell  members.  That  position  does  little  to  counter  the  converse  of  the 
argument,  that  a  local  ER  will  have  a  far  greater  chance  of  encountering  a  terrorist  plot  or 
action  emanating  from  within  our  borders.  The  threat  posed  by  radicalized  prisoners, 
single-issue  terrorists  —  such  as  ELF  or  ALF,  and  more  importantly  local  jihadists  that 
have  a  sympathetic  ideological  link  with  A1  Qaeda  and  similar  groups  —  will  more  likely 
be  discovered  or  encountered  by  local  ERs. 

While  these  attacks  may  lack  the  feared  WMD  capability,  there  should  be 
no  doubt  that  a  group  of  serious  and  motivated  individuals  could  produce  an  attack  that  is 
not  only  physically,  but  psychologically,  catastrophic.  You  need  go  no  further  than  the 
Oklahoma  bombing  to  reinforce  this  point.  Finally,  many  experts  make  the  case  that 
counterterrorism  is  more  appropriately  a  police  mission  rather  than  relying  primarily  on 
the  military.  In  a  paper  authored  by  Bruce  Hoffman  and  Seth  Jones  (draft,  cited  with 
permission)  they  make  the  case  that  police  have  better  training  and  more  experience  in 
responding  to  terrorist  organizations  and,  historically,  have  greater  success  against  them. 
The  paper  continues  to  say  that  the  government  should  enhance  police  capacity  to 
respond  to  the  threat  (specifically  al  Qaeda)  much  more  robustly  than  has  been  done.74 
An  awareness  of  our  local  threat  will  assist  us  in  focusing  our  prevention  efforts  and 
create  a  need  for  intelligence  and  data  collection. 


74  Bruce  Hoffman  and  Seth  Jones,  Countering  a  Resurgent  al  Qaeda  (draft),  cited  with  permission. 
May  22,  2007,  https://www.chds. us/courses/mod/forum/discuss.php?d=8 174,  last  accessed,  March  1, 
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c. 


Strategic  vs.  Tactical 


One  additional  perspective  fusion  centers  have  to  consider  is  the  type  of 
analytical  support  that  they  provide.  The  question  has  arisen:  Should  fusion  centers 
provide  strategic  analysis  in  the  form  of  threat  assessments  or  situational  awareness  for 
local  executives  and  elected  officials  as  the  customer,  or  should  they  concern  themselves 
with  tactical  case  support  for  developing  or  ongoing  investigations? 

The  data  from  the  survey  indicates  that  60  percent  of  the  fusion  centers 
had  both  a  strategic  and  a  tactical  capability.  This  finding  was  supported  by  the 
interviews  from  the  commanders  of  the  four  RTTACs.  The  Bay  Area  RTTAC  and  the 
Sacramento  RTTAC  primarily  do  investigative  tactical  case  support,  but  they  do  some 
strategic  analysis  on  request  or  when  they  deem  such  a  need  exists.  The  LA  RTTAC 
does  some  investigative  case  support  but  primarily  provides  strategic  analysis,  while  the 
San  Diego  RTTAC  does  purely  strategic  support. 

Comparisons  between  fusion  centers  are  difficult,  as  there  are  no 
standardized  definitions  for  the  types  of  analysts  and  what  their  product  is  or  should  be. 
In  the  phone  survey  conducted  by  the  Sacramento  Joint  Powers  Authority  one  of  the 
questions  on  the  survey:  How  are  your  fusion  center  analysts  different  from  crime 
analysts?  Only  four  gave  responses  that  may  indicate  that  strategic  analysis  was  being 
conducted.  Another  question:  What  percentage  of  your  analysts’  time  is  spent  on  terrorist 
threat  analysis?  Eleven  of  the  twenty  three  fusion  centers  responded  low  or  very  low.75 

The  Arizona  Counter  Terrorism  Information  Center  (AcTIC)  has  separate 
analyst  components  that  perfonn  the  distinctly  different  functions  of  tactical  investigative 
case  support  analysis  and  strategic  trend  or  threat  awareness  analysis.  The  tactical 
analyst  unit  has  three  analysts  that  perform  analysis  on  active  cases.  Also  in  the  AcTIC, 
the  Arizona  Department  of  Public  Safety  has  a  strategic  analysis  component  (with  two 
analysts  and  plans  for  two  additional  analysts)  that  focuses  on  national  and  world  events 


75  Sacramento  Joint  Powers  Authority. 
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and  trends,  and  how  they  may  affect  Arizona.  The  AcTIC  also  houses  the  FBI’s  Field 
Investigative  Group  (FIG)  and  their  strategic  analysis  unit.76 

This  data  would  suggest  that  identification  of  customer  and  customer 
needs  is  extremely  important  to  determine  not  only  the  end  product  but  the  value  of  that 
product  to  the  customer.  Needs  identification  will  undoubtedly  help  focus  mission  and 
resource  allocation  within  the  fusion  center  as  well  as  producing  a  usable  product  that 
will  be  of  value  to  the  identified  customers.  Note  that  the  product  need  not  be  limited  to 
strategic  or  tactical,  and  clearly  can  be  both.  To  assist  in  prioritization  of  work  product 
and  resource  allocation,  however,  it  would  be  important  to  know  what  was  the  primary 
expectation. 

Many  of  the  fusion  centers’  employees  who  were  interviewed  for  this 
thesis  repeated  the  complaint  that  they  were  short-staffed  and  that  without  federal  funding 
the  fusion  effort  would  be  in  jeopardy.  It  would  seem  prudent  to  make  a  concerted  effort 
to  seek  out  the  emergency  responder  administrators  and  elected  officials  to  give  them 
regular  threat  assessments  and  situational  awareness  briefings  to  demonstrate  the  value 
and  capability  of  the  unit.  They  should  also  be  made  aware  of,  and  encouraged  to  use, 
the  tasking  capability  to  have  a  strategic  product  prepared  that  is  within  the  purview  of 
the  fusion  center  and  is  of  concern  to  local  officials.  This  level  of  customer  service  and 
interaction  will  not  only  help  educate  administrators  as  to  the  usefulness  of  the  fusion 
center,  but  also  establish  contacts  and  the  beginnings  of  a  network.  This  increased 
interaction  could  lead  to  increased  support  and  funding. 

d.  All  Crimes  vs.  Strictly  Counterterrorist 

One  of  the  most  topical  issues  related  to  fusion  centers  is  the  question  of 
whether  fusion  centers  should  focus  exclusively  on  terrorism,  as  opposed  to  engaging  in  a 
broader  scope  of  all  crimes  and  terrorism.  (All  crimes  rarely  means  “all  crimes”  but  is 
usually  meant  to  be  certain  organized  crimes  or  major  crimes  such  as  narcotics,  crimes  of 
violence  and  gangs,  or  crimes  that  may  be  used  to  support  terrorism  efforts  here  or 

76  Lisa  Ruggeri,  Criminal  Intelligence  Analyst,  Arizona  Counter  Terrorism  Information  Center, 
Interview  December  20,  2007.  Ms  Ruggeri  is  currently  assigned  to  the  FBI  JTTF. 
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abroad,  such  as  financial  crimes  or  fraud).  The  original  intent  of  fusion  centers,  as  they 
first  began  to  emerge  after  9/11,  was  to  focus  explicitly  on  the  threat  of  terrorism.  Since 
that  time,  the  immediacy  of  the  threat  has  faded  and  the  trend  has  started  to  shift  to  an  all¬ 
crimes  approach. 

Jerry  Murphy,  Director  for  Homeland  Security  at  the  Police  Executive 
Research  Foundation  (PERF),  asserts  that,  in  part,  the  shift  is  driven  by  relevance  and 
workload;  there  is  just  not  enough  purely  terrorist  actionable  intelligence  to  justify  all  of 
the  fusion  centers  that  are  in  operation.  He  also  believes  that  a  purely  terrorist  orientation 
would  lead  the  centers  to  become  irrelevant  to  local  law  enforcement,  since  the  FBI  has 
the  primary  counterterrorism  role.77  With  the  exception  of  New  York  City,  he  would 
anticipate  all  of  the  other  fusion  centers  to  begin  a  shift  toward  an  all-crimes  approach. 

Other  supporters  of  a  purely  terrorist  orientation  for  fusion  centers  come 
from  those  fusion  centers  located  in  mega-communities  with  a  high  iconic  value  such  as 
New  York  City  and  Los  Angeles.  The  survey  of  the  four  California  RTTACs  and  the 
California  State  Terrorism  Threat  Assessment  Center  (STTAC)  indicates  that  the 
majority  of  those  centers,  60  percent,  engage  in  an  all-crimes  perspective  for  fusion 
center  operations.  One  of  the  exclusively  counterterrorist  perspectives  was  Los  Angeles, 
(noted  with  permission),  which  investigates  and  analyzes  counterterrorist  activity  but  also 
considers  criminal  activity  with  a  terrorist  nexus  such  as  financial  crimes  (they  maintain 
connectivity  via  the  TLO  program  with  officers  in  the  various  investigative  units).  Due 
to  their  increased  risk  of  attack  and  what  is  very  likely  a  large  volume  of  intelligence,  it 
may  be  prudent  for  those  mega  communities  to  focus  exclusively  on  counterterrorism. 
In  something  of  a  contradiction,  which  is  an  indication  of  the  complexities  associated 
with  this  question,  80  percent  of  the  fusion  centers  identified  themselves  as  “all  crimes” 
in  the  interviews. 

A  partial  explanation  may  come  from  FBI  Special  Agent  Oda,  one  of  three 
co-managers  of  the  LA  RTTAC.  He  objects  to  the  GAO  report,  citing  only  a  small 
number  of  fusion  centers  are  focused  on  counterterrorism.  Oda  notes  that  the  Fusion 

77  Jerry  Murphy,  PERF,  interview,  December  17,  2007. 
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Center  Guidelines  recommend  fusion  centers  consider  an  all-crimes  perspective  in  order 
to  more  fully  appreciate  and  gain  information  on  the  counterterrorism  mission.  While  the 
LA  RTTAC  does  not  supplant  other  investigative  units’  area  of  responsibility  to 
investigate  crime,  they  do  consider  a  terrorist  nexus  to  criminal  activity.  They  rely  on 
interagency  cooperation  to  provide  them  needed  information.  Oda  continues  to  say  that 
LA  RTTAC’s  mission  is  counterterrorism,  complemented  by  reviews  of  other  criminal 
activity.  Oda  illustrates  the  point  by  stating  that  the  vast  majority  of  successful  cases  did 
not  start  out  as  a  terrorist  event  but  evolved  from  other  criminal  activity.78 

The  San  Francisco  Bay  Area  RTTAC  operates  an  all-crimes  fusion  center, 
as  does  the  Sacramento  RTTAC.  The  San  Diego  RTTAC  does  not  operate  in  an  all¬ 
crimes  mode;  it  is  a  member  of  a  fusion  center  that  consists  of  the  RTTAC,  a  Law 
Enforcement  Coordination  Center  (LECC),  and  the  FBI’s  Joint  Terrorism  Task  Force. 
These  three  organizations  fonn  the  fusion  center.  The  LECC  main  function  is  the 
operation  of  four  intelligence  teams  that  focus  on  narcotics,  gangs,  border  issues,  and 
financial  crimes.  The  LECC  does  not  have  a  formal  concept  of  operations  or  formalized 
information  exchange  mechanism  with  the  RTTAC,  but  that  is  an  identified  problem  that 
will  be  developed  as  the  center  matures.  The  San  Diego  model  will  be  worthwhile  to 
observe  as  it  develops. 

A  consideration  for  determining  whether  a  fusion  center  should  be  all 
crime,  or  purely  counterterrorist,  should  be  predicated  on  the  immediate  threat  picture  in 
which  the  fusion  center  is  operating.  A  majority  of  the  state  and  local  fusion  centers  have 
an  all-crime  perspective  or  mission  in  their  fusion  centers.  Twenty-three  of  thirty-six 
operational  fusion  centers  that  provided  mission  statements  to  the  GAO  had  missions  that 
involved  collecting,  analyzing  and  disseminating  criminal  as  well  as  terrorism-related 
information.79  According  to  the  GAO  report,  more  than  half  of  the  fusion  centers  have 
an  all-crime  mission. 


78Steve  Oda,  FBI  Special  Agent,  Co-Manager  LA  RTTAC,  interview,  December  17,  2007. 

79  Eileen  R.  Larence,  Director  of  Homeland  security  and  justice  issues,  GAO  testimony  before  the 
subcommittee  on  intelligence  information  sharing  and  terrorism  risk  assessment.  Committee  on  Homeland 
Security,  House  of  Representatives,  space  GAO  -07-1241T,  United  States  Government  accountability 
office,  September  27,  2007,  6-7. 


54 


Phil  Bodenhorn,  supervisor  of  the  Sacramento  FIG,  takes  the  position  that 
law  enforcement  has  the  mission  to  protect  its  citizens  from  harm.  He  believes  that  local 
fusion  center  intelligence  requirements  can  be  written  for  local  crime  requirements,  as 
well  as  for  national  security  counterterrorism.  This  will  undoubtedly  create  a  large  list  of 
requirements  that  must  be  distilled  into  a  more  precise  list.  He  believes  that  local  law 
enforcement  could  manage  this  with  training,  written  guides,  and  the  use  of  terrorism 
liaison  officers  as  a  resource  for  officers  in  the  field.80 

The  counterargument  to  the  purely  terrorism  position  is  varied  and  robust. 
Most  jurisdictions  do  not  have  enough  activity  that  can  be  readily  identified  as 
exclusively  terrorist  to  sustain  a  fully  staffed  fusion  center.81  The  survey  data  of 
California’s  fusion  centers  supported  this  assertion;  50  percent  of  the  fusion  centers  felt 
that  there  was  not  enough  purely  counterterrorist  activity  to  consistently  support  a  fully 
staffed  fusion  center.  Only  the  most  at-risk  agencies  would  consider  their  jurisdiction  to 
be  sufficiently  at  risk  of  a  terrorist  attack  that  they  would  dedicate  scarce  resources  to  the 
sole  effort  of  intelligence  collection  and  analysis  of  a  purely  terrorist  nature.  Director 
Bettenhausen  would  agree  that,  in  his  opinion,  there  is  not  enough  work  in  the  fusion 
centers  for  strictly  counterterrorism.  He  adds  that  everyday  crimes  can  turn  up 
information,  especially  crimes  that  can  support  terrorist  operations.  The  public  derives  a 
benefit  from  the  dual  mission  of  conducting  all  crimes  and  counterterrorist  analysis.82 

Sheriff  McGinness  took  the  position  that  fusion  centers  should  be  all¬ 
crimes  centers,  noting  that  terrorist  activity  would  be  included  in  that  category  and  clearly 
would  be  a  priority.  He  added  that  numerous  high-profile  crime  and  terrorist  incidents 
had  been  solved  by  happenstance  unifonned  officer  contacts;  these  contacts  in  general 
could  potentially  yield  a  significant  amount  of  information.83  Chief  Braziel  weighed  in 
on  the  issue  unequivocally  when  he  discussed  the  topic,  saying  that  for  local 
administrators  to 

80  Bodenhorn,  interview. 

81  Johnstone,  personal  communication,  September  2007. 

82  Bettenhausen,  interview. 

83  McGinness,  interview. 
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continue  to  support  fusion  centers,  particularly  when  funding  for  them  starts  to  disappear, 
they  will  have  to  fight  crime,  specifically  major  crimes  or  crimes  that  can  have  a  terrorist 
nexus.84 

The  survey  data  also  suggests  that  useable  intelligence  product  would  be 
lost  if  their  center  were  to  focus  exclusively  on  counterterrorist  activity.  Of  the  reporting 
fusion  centers,  half  stated  that  there  would  “usually”  or  “almost  always”  be  a  loss  of 
intelligence  data.  Half  of  the  respondents  also  felt  that  value  to  consumers  would 
“usually”  or  “almost  always”  be  reduced,  and  25  percent  felt  that  “sometimes”  the  value 
to  consumer  would  be  reduced. 

Another  potential  hazard  of  following  a  purely  terrorist  approach  is  that  if 
there  were  an  insufficient  level  of  meaningful  work  and  analysts  were  not  being 
challenged,  not  only  would  their  skills  erode  but  they  might  seek  other  opportunities.  It 
is  already  very  difficult  for  fusion  centers  to  meet  their  staffing  requirements;  analysts 
often  leave  if  they  find  the  work  unrewarding.85  Chief  Braziel  made  the  observations 
that  there  was  a  need  to  keep  analysts  busy  with  real  crime  problems  that  are  active  in 
their  area  so  their  skills  will  remain  sharp.  He  offered  prison  gangs  a  one  potential  area 
of  investigation. 

Many  terrorists  allegedly  sustain  themselves  by  petty  criminal  activity, 
which  may  be  uncovered  by  officers  on  a  routine  contact.  It  has  been  reported  that  many 
terrorist  organizations  support  themselves  through  a  variety  of  crimes  including,  but  not 
limited  to:  identity  theft,  counterfeiting,  financial  crimes,  fraud  and  narcotics.  If  a  fusion 
center  were  purely  counterterrorist-oriented,  many  connections  to  criminal  activity  with  a 
potential  terrorist  nexus  would  likely  go  uncovered  or  unreported;  seemingly  innocuous 
bits  of  information  may  go  unrecognized. 

A  counterargument  to  the  terrorist  as  a  petty  criminal  is  presented  by  the 
work  of  Marc  Sageman.  He  makes  the  case  that  the  evidence  does  not  support  the 


84  Braziel,  interview. 

85  Murphy,  interview. 
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frequent  proclamation  that  terrorists  (specifically  what  he  terms  global  Salafi  terrorists) 
engage  in  criminal  activity  to  advance  their  cause.86 

Most  large  and  midsize  state  and  local  fusion  centers  are  supported  by 
local  law  enforcement  who  will  expect  some  intelligence  product  that  is  locally 
actionable  as  part  of  a  quid  pro  quo.  In  the  survey,  the  fusion  centers  reported  that  they 
felt  that  support  from  parent  agencies  would  “sometimes”  be  reduced  if  the  fusion  center 
did  not  have  an  all-crime  perspective.  If  fusion  centers  are  to  be  self-sustaining,  they  will 
need  to  demonstrate  value  to  local  officials  and  gain  their  goodwill  and  support. 
Producing  a  product  that  is  timely,  relevant  and  locally  actionable  will  advance  this 
cause. 

The  crimes  that  these  fusion  centers  tend  to  focus  on  outside  of  terrorism 
are  those  that  are  serious  or  organized  criminal  enterprises.  The  most  prevalent  are 
narcotics,  money  laundering,  counterfeiting,  financial  crimes,  crimes  of  violence  and 
gangs.  Financial  crimes  and  gang  activity  were  investigated  at  a  significantly  higher 
level  than  the  other  crimes. 

Addressing  serious  crime  problems  will  help  the  fusion  center  garner 
support  in  the  event  of  a  need  for  local  funding,  or  even  sustained  federal  funding.  Brian 
Banning  takes  the  position  that  one  way  for  fusion  centers  to  show  value  is  to  “catch  a 
bad  guy.”  This  could  be  done  with  small  investigative  teams  that  would  work  tips  the 
JTTF  could  not  get  to  in  a  timely  fashion  or  had  passed  on.  These  may  be  terrorist  threats 
or  major  criminal  cases.  This  team  would  work  these  cases  as  far  as  they  could  go.  He 
feels  some  locally  generated  successes  will  go  a  long  way  to  gain  local  and  federal 
support  for  the  fusion  centers.  He  would  also  argue  for  a  computer  forensic  capability 
within  each  fusion  center.  It  is  impossible  to  know  if  any  terrorist  intent  exists  in  many 
criminal  cases  without  opening  up  a  computer.87 


86  Marc  Sageman,  “Understanding  Jihadi  Networks,”  Strategic  Insight  IV,  Issue  4  (April  2005)  Center 
for  Contemporary  Conflict,  www.ccc.nps.navv.mil,  last  accessed  January  4,  2008. 

87  Brian  Banning,  Lt.,  Sacramento  County  Sheriff  s  Department,  temporarily  assigned  Critical 
Infrastructure  Protection,  California  Office  of  Homeland  Security,  interview,  January  3,  2008. 
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e.  Prioritization 

In  addition  to  prioritizing  what  level  or  amount  of  work  is  to  be  done 
between  the  strategic  analysis  and  tactical  case  support  categories,  the  fusion  centers 
must  have  a  system  of  prioritizing  or  triaging  tips  and  leads.  All  of  the  tips  and  leads 
should  get  some  level  of  at  least  a  cursory  review;  however,  the  degree  to  which  each  tip 
or  lead  is  pursued  should  undergo  some  sort  of  evaluative  process.  Indeed,  without  some 
sort  of  screening  process  or  triage,  fusion  center  intake  could  become  overwhelmed  and 
wholly  ineffective. 

One  system  of  triaging  tips  and  leads  to  ascertain  a  weighted  score  for 
investigation  priority  was  advanced  by  Raphael  Brinner,  an  analyst  for  the  U.S.  Coast 
Guard.  Brinner  presented  his  model  to  the  RTTAC  Analyst  Training  Conference  in 
Monterey  California.  In  a  brief  overview  of  his  model,  as  yet  unpublished  (presented 
here  with  permission),  Brinner  highlights  the  relationship  between  threats,  vulnerabilities 
and  incidents  with  individual  domains  in  Venn  diagrams.  A  full  treatment  of  the  model  is 
beyond  the  scope  of  this  thesis,  but  is  presented  as  an  area  that  should  be  addressed  by 
fusion  centers.  The  USCG  approach  is  to  measure  suspicion  using  their  MEDS 
(Minimal,  Elevated,  Demonstrated,  Strong)  threat  rating  system  using  the  objectives  of: 
1.  highlight  anomalies;  2.  keep  routine  activity  in  perspective;  3.  apply  rigor  to  a 
subjective  process.  Key  issues  are  to  recognize  your  biases,  set  the  activity  in  the  local 
contexts,  individual  incidents  are  poor  metrics  (the  sample  size  is  too  small),  and  local 
trends  are  more  important  that  national  trends  (except  for  the  aviation  industry).  Finally, 
triage,  objective  language,  and  investigation  will  give  data  context  and  meaning.88 

With  a  triaging  system  in  place,  priority  investigations  can  be  targeted  at 
the  tips  that  are  associated  with  known  vulnerabilities,  linked  to  suspected  threats  and 
involve  incidents  that  are  suspicious  anomalies. 


88  Rafael  Brinner,  Analyst,  U.S.  Coast  Guard,  Maritime  Intelligence  Fusion  Center  Pacific,  Triaging 
Suspicious  Activity,  a  Model  for  Homeland  Threat  Analysis,  February  2008.  E  mail  provided  with 
permission,  Rafael.J.Brinner@uscg.dhs.gov. 
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3.  Leadership 


As  has  already  been  stated  the  literature  is  very  weak  or  silent  on  the  issue  of  who 
should  lead  fusion  centers.  This  may  be  because  the  federal  government  is  sensitive  to 
the  concerns  of  local  control  and  is  unwilling  to  enter  into  a  political  arena  that  may  be 
fraught  with  controversy;  or  it  may  be  that  —  due  to  the  varying  needs  and  organizational 
structure  of  the  state  and  local  fusion  centers  —  management,  or  more  importantly 
leadership,  is  not  fully  developed  in  the  aforementioned  documents.  In  all  likelihood,  it 
is  a  combination  of  the  two.  As  has  been  documented  in  numerous  studies,  however,  the 
success  or  failure  of  any  new  venture,  particularly  a  collaboration  of  different  entities 
with  different  cultures,  requires  strong  (not  autocratic)  leadership.  The  leader  must  be 
able  to  instill  a  vision  and  have  the  ability  to  translate  that  vision  into  several  different 
dialects,  if  you  will,  to  be  able  to  talk  to  fire,  law,  public  health  etc. 

A  leader  taking  on  this  type  of  challenge  must  be  able  to  not  only  build  and 
maintain  relationships  but  intuit  what  relationships  are  necessary  but  do  not,  as  yet,  exist. 
This  will  necessitate  establishing  common  modes  of  communication,  but  more 
importantly,  creating  a  common  desire  or  identification  of  a  need  to  communicate  — 
which  will  be  made  more  even  more  difficult  in  light  of  the  phenomena  of  the  fading 
threat  created  by  the  length  of  time  since  we  were  successfully  attacked.  Such  a  leader 
will  require  an  abundance  of  trust,  competence  and  credibility.  Successfully  managing  a 
fusion  center  into  the  future  will  require  more  than  an  intelligence  professional  or  a 
skillful  manager,  it  will  require  a  leader  with  excellent  networking  skills. 

The  vast  majority  of  fusion  centers  have  statewide  responsibility.  According  to 
the  CRS  July  2007  report,  many  were  originally  state  police  agencies  that  were  given  an 
additional  task  of  intelligence  production,  making  them  the  fusion  center.  It  is  not  a  great 
deductive  leap  to  make  the  conjecture  that  state  intelligence  centers  or  state  law 
enforcement  centers  would  be  hierarchical  in  nature  and  lead  with  a  top-down 
perspective.  The  regional  fusion  centers,  which  were  less  than  20  percent  of  the  total 
number  of  fusion  centers,  were  generally  those  that  were  located  in  UASI  cities.  The 
CRS  report  found  that  these  regional  fusion  centers  were  more  likely  than  the  state 
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counterparts  to  have  multiple  agencies  "involved  in  their  development  in  day-to-day 
operational  management."89  If  leadership,  guided  by  networked  relationships,  is  truly 
beneficial,  the  regional  fusion  centers  that  were  forced  into  collaborative  relationships  in 
the  developmental  stages  of  their  emergence  may  well  prove  to  be  the  beneficiaries  of 
necessity. 

It  will  be  the  burden  of  state  agencies  to  move  from  the  comfort  of  the  known  and 
entrenched  style  of  leadership  to  adopt  a  truly  collaborative  and  inclusive  leadership  style 
that  will  embrace  a  network  philosophy.  It  will  not  be  easy  to  give  up  total  control  but,  in 
a  catastrophic  event,  no  one  will  have  control  and  no  single  entity  will  have  a  chance  of 
responding  adequately.  A  diverse  and  reflexive  network  will  be  a  necessity  to  respond  to 
the  threats  of  the  future. 

B.  ANALYSTS 

Staffing  the  fusion  center  is  a  critical  function  that  is  often  overlooked  or  not 
adequately  considered.  The  analysts  selected  to  work  in  the  fusion  center  must  be 
selected  on  the  basis  of  ability,  capability  and  the  mission  of  the  center.  Basically,  two 
categories  of  analyst  are  assigned  to  fusion  centers.  The  first  is  crime  analysts  (tactical) 
who  generally  have  a  law  enforcement  background.  The  second  is  intelligence  analysts 
(strategic)  who  generally  have  a  background  in  either  the  military  or  a  federal  intelligence 
service.  Both  require  a  level  of  training,  education  and  expertise,  but  have  distinctly 
different  orientations  in  their  approach  and  expertise.  Intelligence  analysts  frequently 
have  a  higher  level  of  formal  education  and  perfonn  predictive  strategic  assessments; 
crime  analysts  generally  have  more  experience  in  case  support  and  link  analysis,  and 
perform  tactical  or  case  support. 

From  the  IC's  perspective,  a  strategic  analyst,  as  described  by  Phil  Bodenhom,  is 
one  who  has  a  level  of  subject  matter  expertise  that  has  been  gained  with  years  of 
experience.  Strategic  analysts  must  work  from  a  basis  of  hypothesis  and  very  often  must 
rely  on  sketchy  information  that  must  be  qualified  by  their  domain  of  expertise  and 


89  Masse  et  at,  CRS  report  for  Congress,  20. 
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knowledge  of  all  aspects  of  the  threat.  This  level  of  knowledge  is  required  to  make 
predications  and  assign  degrees  of  confidence,  which  can  take  on  the  quality  of  peering 
into  a  “crystal  ball.”  This  level  of  experience  gives  them  the  moral  courage  to  make 
assessments  —  and  stand  by  them.  Conversely,  some  analysts  do  research  on  after-the- 
fact  crimes  or  an  incident;  this  is  investigative  research,  not  intelligence  analysis.90 

Frequently,  sworn  law  enforcement  officers  and  firefighters  are  chosen  to 
function  as  fusion  analysts.  Often,  these  officers  have  little  training  or  background  for 
this  position.  The  type  of  personality  that  is  drawn  into  the  field  of  law  enforcement  or 
firefighting  is  not  generally  consistent  with  the  type  of  personality  that  is  willing  to  sit  at 
a  desk  all  day  and  read  copious  amounts  of  material  from  disparate  sources,  recognizing 
patterns  and  integrating  them  into  a  potential  threat  pattern.  That  is  a  special  skill  that 
requires  aptitude  and  training.  We  need  to  recognize  and  hire  staff  to  that  end.  That  is 
not  to  say  that  certain  law  enforcement  officers,  fire  fighters  or  other  emergency 
responders  cannot  make  good  analysts,  just  that  the  ability  to  be  a  professional 
intelligence  analyst  has  a  special  skill  set,  experience  and  aptitude.  Robert  Galameau,  co¬ 
manager  of  the  LA  RTTAC,  gives  his  perspective  on  the  issue  of  law  enforcement 
analysts  stating,  “The  more  difficult  analyst  to  work  with  is  the  law  enforcement  analysts. 
Cops  as  analysts  are  in  an  uncommon  role  and  the  transition  is  often  difficult.  Cops  want 
to  do  things.”91 

Another  perspective  on  the  issue  is  presented  by  Sheriff  McGinness.  Having 
specially  trained  analysts  to  provide  continuity  and  historical  perspective  is  useful  and 
necessary;  however,  Sheriff  McGinness  also  takes  the  position  that  having  a  law 
enforcement  presence  in  the  analyst  pool  adds  value  to  the  fusion  process  —  and  to  the 
organization  when  the  officer  returns  to  his  or  her  agency.  The  knowledge  and  skill 
gained  in  that  assignment  can  have  a  beneficial  effect  on  the  organization.92 


90  Bodenhorn,  interview. 

91  Galameau,  interview. 

92  McGinness,  interview. 
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Unlike  some  fusion  centers,  the  Arizona  AcTIC  does  not  use  any  law  enforcement 
or  other  emergency  responder  personnel  as  analysts.  The  analyst  role  is  strictly  a  civilian 
position  with  its  own  career  path.  All  of  the  analysts  in  the  tactical  analyst  section  of 
AcTIC  have  a  minimum  of  a  BA.  Degree  and,  as  part  of  the  hiring  process,  candidates 
are  tested  on  analytical  thinking.93 

Crime  analysts  require  a  professional  background  and  training  that  cannot  be 
accomplished  with  a  two-year  rotation  common  to  many  sworn  law  enforcement  and 
firefighter  analysts  assigned  to  fusion  centers.  Further  exacerbating  the  problem,  of 
having  rotating  analysts,  is  the  issue  of  clearances.  To  be  effective,  one  must  have  access 
to  classified  databases.  These  are  generally  controlled  by  the  FBI,  who  has  the 
jurisdiction  to  investigate  crimes  of  terrorism.  Access  to  these  databases  cannot  be 
granted  without  a  top-secret,  secure,  compartmentalized  information  (TS  SCI)  clearance. 
From  the  date  of  application,  it  takes  approximately  one  to  two  years  to  gain  this 
clearance  (it  has  been  reported  that  this  timeframe  is  being  driven  down  to  as  fast  as  nine 
months  in  some  jurisdictions).94  Given  the  time  it  takes  to  select,  train  and  obtain  a 
clearance  for  an  analyst,  if  a  fusion  center  were  to  rely  on  sworn  officers  or  anyone  else 
that  must  rotate  on  a  two-  to  three-year  basis,  one  can  be  certain  that  the  effectiveness  of 
the  analytical  capability  of  that  fusion  center  will  be  significantly  degraded.  If  a  fusion 
center  has  a  rotation  or  retention  issue  with  analytical  staff,  they  will  perpetually  be  in 
training,  pending  a  clearance,  and  lacking  any  historical  perspective. 

To  illustrate  the  point  the  LA  RTTAC  has  approximately  nineteen  analysts.  Ten 
of  them  are  from  LASO  or  LAPD.  They  have  lost  nine  analysts  in  the  past  year-and-a- 
half  due  to  turnover.  It  takes  about  nine  months  to  get  an  analyst  a  top-secret  clearance, 
and  then  they  have  to  train  them  on  the  databases  and  the  process  of  intelligence.  They 
are  perpetually  in  the  training  mode.95  As  reported  in  the  survey  data,  of  the  five 
California  fusion  centers,  two  of  them  had  less  than  50  percent  of  their  staff  with 


93  Ruggeri,  interview. 

94  Galarneau,  interview. 

95  Ibid. 
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clearances  to  access  classified  databases,  and  two  more  had  between  50  and  75  percent  of 
their  staff  with  access  to  classified  databases. 

A  confidential  source,  with  ten  years  of  experience  in  the  intelligence  analysis 
field,  gave  the  opinion  that  the  vast  majority  of  the  analysts  in  the  fusion  centers  in  the 
RTTAC  and  the  STTAC  were  crime  analysts  and  lacked  the  experience,  education  and 
skill  set  of  an  intelligence  analyst.  This  was  chiefly  borne  out  in  their  product,  which 
lacked  both  quality  and  quantity.  The  significant  issue  was  that  the  products  reported 
observations  but  did  not  produce  an  analysis  of  the  observations  or  predictions.  The 
products  were  too  few  and  lacked  recommendations  that  could  direct  policy.  The  source 
praised  the  fusion  center  analysts,  which  were  primarily  criminal  analysts,  for  their 
criminal  or  tactical  case  support.  It  was  felt  that  much  more  experience  and  education 
was  needed  before  these  criminal  analysts  could  be  considered  intelligence  analysts.  It 
was  also  acknowledged  that  there  was  less  call  for  “strategic”  analysts  by  the  current 
caseload.  The  majority  of  the  analytical  work  was  accomplished  at  the  tactical  case 
support  level,  which  was  where  the  majority  of  the  analysts  had  their  greatest  strengths. 
The  sources  also  mentioned  that  a  lack  of  threat  data  inhibited  the  depth  of  their  work 
product. 

The  question  was  also  raised  as  to  whether  there  was  enough  demonstrated  benefit 
to  sustain  the  fusion  centers  if  they  did  not  produce  some  material  benefit  for  an 
identified  customer  base,  considering  the  high  cost  of  operation.96 

1.  Training 

According  to  the  survey,  three  of  the  five  fusion  centers  had  over  76  percent  of 
their  staff  trained  in  intelligence  analysis.  One  of  the  fusion  centers  only  had  26-50 
percent  of  staff  trained  in  intelligence  analysis,  but  it  is  still  in  the  developmental  stages. 
The  most  commonly  reported  training  that  the  analysts  received  was  the  Foundations  of 
Intelligence  Analysis  Training  (FIAT)  from  the  International  Association  of  Law 
Enforcement  Intelligence  Analysts  (IALEIA),  which  is  a  non-profit  professional 


96  Personal  communication  with  a  confidential  source  who  is  a  career  intelligence  analyst. 
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organization  dedicated  to  advance  law  enforcement  intelligence  analysis.  The  other 
major  provider  of  analyst  training  is  the  Law  Enforcement  Intelligence  Unit  (LEIU). 
LEIU  is  an  association  formed  to  promote  criminal  intelligence  analysis;  as  laudable  as 
their  goal,  they  have  no  mandate  to  enforce  or  sanction  for  a  lack  of  standards. 

The  issue  of  requirements  for  training  is  dependent  on  the  type  of  analyst  one  is 
considering.  The  educational  requirements  that  the  intelligence  community  in  the  FBI  or 
DHS  considers  qualified  for  an  intelligence  analyst  is  at  a  bare  minimum,  a  bachelor's 
degree  in  a  targeted  major  and  most  likely  a  masters  degree  or  Ph.D.,  with  some  work 
experience,  and  possibly  language  abilities  or  cultural  experience.  Training  programs  for 
these  individuals  exist  within  the  FBI  and  CIA,  but  these  programs  focus  on  honing 
existing  skills.  Analytical  training  for  criminal  analysts  would  require  much  less  formal 
education,  but  many  of  the  same  skills  in  critical  thinking;  these  requirements  are  in 
addition  to  the  ability  to  conduct  tactical  case  support  utilizing  link  analysis  and  other 
investigative  tools. 

In  the  infonnal  phone  survey  conducted  by  the  Sacramento  Joint  Powers 
Authority,  the  twenty-one  fusion  centers  that  responded  to  the  survey  identified  analytical 
skills  and  writing  skills  as  the  area  where  their  analysts  needed  the  most  improvement. 
Eighteen  of  the  twenty-one  centers  stated  that  their  analysts  had  received  some  training  in 
analytical  thinking  and  analytical  tools.  The  training  that  was  identified  as  most  needed 
included:  analytical  skills,  terrorism  fundamentals,  report  and  analytical  writing.  Other 
identified  training  needs  included  identifying  reportable  intelligence,  intelligence 
methodologies,  open-source  exploitation,  anticipating  law  enforcement  needs, 
advanced  research  skills,  and  analytic  tools.97 

What  is  lacking  is  a  government-sanctioned  analyst  training  program  to 
standardize  training  regimen  and  requirements  (this  comment  is  not  to  infer  in  any  way 
that  either  of  the  above  organizations  is  anything  other  than  professional).  However, 


97  Sacramento  Joint  Powers  Authority. 
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these  professional  organizations  would  benefit  from  having  the  support  of  a  government 
agency  with  adequate  funding,  rather  than  relying  on  nonprofit  status  or  other  means  to 
support  this  necessary  training. 

This  sentiment  is  reinforced  by  RTTAC  co-manager  FBI  Special  Agent  Steve 
Oda  when  he  makes  the  observation  that  we  do  not  have  a  robust  national  training 
program  to  take  people  from  an  undergraduate  degree  to  a  trained  analyst.  The  FBI  and 
DHS  have  training  that  can  take  an  existing  analyst  with  a  master’s  degree  or  Ph.D.  and 
develop  those  skills.  But  no  program  currently  exists  to  take  someone  from 
undergraduate  to  analyst  of  a  standard  recognized  by  the  intelligence  community.  Steve 
Oda  went  on  to  say  that  one  or  two  quality  analysts  make  a  tremendous  impact  within  the 
fusion  center.98 

Brian  Banning,  the  former  Deputy  Commander  of  the  Sacramento  RTTAC,  felt 
that  the  crime  or  tactical  analysts  were  very  well-trained;  in  fact,  he  described  them  as  the 
most  trained  group  he  has  ever  worked  around.  He  added  that  the  training  lacked 
standardization,  but  that  efforts  appeared  to  be  underway  between  the  major  providers  to 
establish  formal  standards.  Banning  took  the  same  position  as  others  in  identifying  two 
distinct  groups  of  analysts  —  the  tactical  versus  the  intelligence  or  strategic  analyst.  He 
identified  the  intelligence  analyst  as  being  capable  of  looking  at  geopolitical  trends  and 
applying  that  perspective  to  our  region  to  make  predictions  on  local  potential  for  groups 
or  individuals.  He  noted  that  there  is  a  difference  in  the  product  between  the  two  groups 
of  analysts.99 

The  confidential  source  also  felt  as  though  there  was  plenty  of  good  criminal 
analyst  training  available,  there  was  very  little  “all  source”  strategic  analyst  training 
available,  outside  of  Washington  DC.  The  source  felt  that  there  is  no  identifiable  vehicle 
for  local  analysts  to  gain  the  necessary  training  to  become  a  strategic,  all-source 


98  Oda,  interview. 

99  Banning,  interview. 
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intelligence  analyst.  It  was  recommended  that  perhaps  mobile  training  teams  from 
accredited  training  facilities  in  Washington,  DC,  provide  the  necessary  training  to 
upgrade  local  analysts’  skills.100 

Analysts,  strategic  analysis  in  particular,  must  be  able  to  articulate  how  likely  they 
think  a  thing  is  and  to  what  degree  they  have  confidence  in  their  assessment.  In  other 
words,  they  need  to  be  able  to  say  something  along  the  lines  of,  “We  think  it  is  very 
likely  that  this  is  going  to  happen,”  with  a  high  degree  of  confidence,  or  say  that  “we  feel 
that  this  is  very  unlikely,  but  we  have  a  low  degree  of  confidence.”  Strategic  analysts 
need  to  be  able  to  have  confidence  in  the  accuracy  of  their  opinions.  This  is  so  because 
their  assessments  are  judgments,  not  fact,  and  they  need  to  be  able  to  withstand  political 
pressure  to  manipulate  the  outcome  of  their  assessments.  Analysts  need  to  have  the 
courage  of  their  convictions  and  the  character  to  stand  by  them,  even  when  pressured  to 
"re-evaluate"  their  assessment.  Appropriate  education,  not  just  training,  will  help  provide 
the  needed  confidence. 

One  complaint  —  commonly  brought  up  throughout  all  the  interviews  related  to 
analysts  and  their  training  —  was  the  accessibility  of  databases.  It  is  not  unusual  for  an 
analyst  to  have  to  run  over  fifty  different  databases  to  complete  an  investigative  check  on 
a  tip  or  a  lead.  There  are  efforts  underway  (Cop  Link)  to  integrate  the  various 
jurisdictions’  record  management  systems  so  that  one  query  could  run  all  the  databases. 
Everyone  queried  on  this  point  energetically  supported  this  concept.  It  was  also 
discovered  that  a  civilian  contract  analyst  retired  from  law  enforcement  with  a  top-secret, 
secure  compartmentalized  information  clearance  (TS  SCI)  could  not  access  the  California 
law  enforcement  teletype  system  (CLETS),  but  a  entry-level  clerk  in  any  law 
enforcement  agency  would  have  unrestricted  access  to  the  same  database.101 


100  Personal  communication  with  a  confidential  source  who  is  a  career  intelligence  analyst. 

101Mike  Sena,  Commander,  Northern  California  Regional  Terrorism  Threat  Assessment  Center, 
interview,  November  19,  2007. 
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C.  INTELLIGENCE  DISSEMINATION 

Dissemination  has  two  distinct  and  very  important  components.  The  first  is  who  it 
is  disseminated  to,  the  second  is  how  it  is  disseminated.  Possession  of  intelligence  has  no 
value  unless  that  intelligence  gets  to  people  who  can  put  it  to  use.  Therefore,  it  is 
important  for  intelligence  to  reach  as  wide  a  range  of  personnel  as  possible  without 
compromising  the  integrity  of  that  information,  particularly  sources  and  methods.  There 
is  some  controversy  in  the  emergency  responder  community  about  the  dissemination  of 
unclassified  infonnation. 

Many  documents  are  prepared  and  released  at  the  Law  Enforcement  Sensitive 
level  (LES)  while  others  are  prepared  and  released  at  the  For  Official  Use  Only  level 
(FOUO).  The  distinction  is  that  firefighters  and  other  non-law  enforcement  emergency 
responder  partners  will  be  unable  to  receive  LES  distributions,  while  all  in  the  ER 
community  should  be  clear  to  receive  FOUO  information.  The  release  of  material  at  the 
LES  level  has  caused  some  dissension  between  the  fire  and  law  communities. 

Three  main  issues  are  raised  in  the  FOUO/LES  controversy.  The  first  issue  is 
need  to  know;  the  producers  of  some  intelligence  product  feel  some  information  that  they 
produce  should  be  restricted  to  law  enforcement  on  a  need-to-know  basis  to  protect 
aspects  of  the  inquiry  or  investigation.  The  counterargument  is  that  LES  distribution  is 
so  widely  disseminated,  with  no  true  legal  controls,  that  this  information  is  compromised 
as  soon  as  it  is  disseminated. 

The  second  issue  is  one  of  cultural  differences  between  law  enforcement  and  fire 
personnel.  The  argument  goes  that  law  enforcement  is  more  familiar  with  investigations 
and  the  need  for  secrecy  and  confidentiality,  whereas  fire  personnel  who  have  not  been 
exposed  to  the  cultural  need  for  secrecy  are  less  concerned  with  controlling  the  access  of 
information  to  unauthorized  recipients.  This  position  is  generally  supported  by  anecdotal 
reports,  which  can  cite  violations  in  either  camp.  An  illustration  is  the  position  held  by 
Tim  Johnstone,  Sacramento  RTTAC  Commander,  when  he  said  that  we  needed  to  vet  the 
product  to  the  audience.  Cops  will  continue  to  get  a  higher  degree  of  information  and 
intelligence,  and  there  will  be  a  need  to  scrub  intelligence  for  fire  to  get  what  they  need 
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without  worrying  about  the  loss  of  secrets.  He  also  noted  that  it  was  just  a  function  of 
education  and  time  before  the  fire  personnel  were  where  they  needed  to  be  on 
information  security  and  control.  He  also  cited  an  incident  in  which  a  fire  department 
employee  released  a  FOUO  document  to  the  local  press,  which  caused  some  concern  and 
tension.  The  problem  was  addressed  and  has  not  recurred.102 

The  third  issue  is  created  by  what  is  called  originator  control.  This  is  the 
principle  that  if  an  agency  or  entity  produces  and  disseminates  information  or  intelligence 
at  a  certain  level,  that  information  or  intelligence  cannot  be  disseminated  at  a  lower  level. 
Therefore,  if  a  local  agency  receives  information  at  the  LES  level,  they  have  no  recourse 
but  to  honor  that  level  of  classification  and  disseminate  at  the  same  level.  It  is  possible  to 
go  back  to  the  originator  for  permission  to  re-class.  This  is  a  timely  process,  however, 
and  a  rare  occurrence,  as  most  infonnation  is  time-sensitive. 

Greg  Ladas,  TLO  administrator  for  the  Sacramento  RTTAC,  agrees  that  these 
issues  cause  problems  with  dissemination.  The  Sacramento  RTTAC  Fire  and  Law  TLOs 
currently  receive  e-mail  distributions  of  intelligence,  but  they  are  on  different  lists  to 
respect  the  handling  caveats  associated  with  different  distribution  levels,  specifically  LES 
and  FOUO.  Ladas  stated  that  even  though  there  are  not  legal  sanctions  the  intelligence 
community  is  one  of  trust,  and  if  a  center  does  not  respect  the  handling  caveats  they  will 
be  shut  off  from  further  intelligence.  A  common  problem  with  dissemination,  most 
frequently  associated  with  federal  documents  (although  the  problem  is  widespread),  is  the 
dual  labeling  of  a  document  with  LES  and  LOUO.  This  dual  labeling  precludes  the 
dissemination  of  this  product  to  anyone  other  than  law  enforcement,  which  restricts  the 
audience  and  potential  effectiveness. 

Another  related  problem  that  is  frequently  cited  is  that  of  over-classification  of 
documents.  Ladas  mentioned  that  this  is  a  common  problem,  which  he  attributes  to 
misunderstanding  the  need  or  audience;  also,  a  fear  of  classifying  a  document  too  low 
leads  some  to  automatically  classify  at  the  higher  level.103 

102  Johnstone,  interview,  November  29,  2007. 

103  Greg  Ladas,  Sergeant,  Sacramento  County  Sheriff  s  Department,  RTTAC  TLO  Manager, 
interview,  January  3,  2008. 
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The  survey  data  gives  weight  to  the  need  to  resolve  this  controversy.  Two  of  the 
five  fusion  centers  produce  between  25  and  50  percent  of  their  product  at  the  LES  level, 
and  a  third  fusion  center  produced  50  to  75  percent  of  their  product  at  the  LES  level.  The 
remaining  two  fusion  centers  produce  between  10  and  25  percent  of  their  product  at  the 
LES  level.  It  is  clear  that  a  great  deal  of  information  is  being  produced  and  disseminated 
at  the  LES  level.  It  would  be  in  the  best  interest  of  an  “information  sharing  environment” 
to  minimize  LES  dissemination  unless  it  is  absolutely  called  for.  While  there  is  a  need 
for  LES  products,  guidelines  for  the  decision  to  disseminate  at  the  LES  level  vs.  the 
FOUO  level  should  be  developed  and  enforced  so  that  this  classification  is  not  being  used 
out  of  habit  or  out  of  cultural  bias. 
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IV.  ANALYSIS  OF  CURRENT  PRACTICES  FOR  DATA 

COLLECTION 


A  great  deal  has  been  written  about  fusion  centers  and  the  need  to  involve  our 
emergency  responder  community,  particularly  law  enforcement.  Much  less  has  been 
written  about  how  we  are  actually  going  to  engage  this  community  of  responders.  What 
is  clear  is  that  for  local  fusion  centers  to  produce  locally  relevant  and  actionable  product, 
they  will  need  to  gain  as  complete  a  picture  as  possible,  which  will  require  the  collection 
of  information  by  local  emergency  responders.  This  information  may  be  the  result  of  a 
vehicle  stop,  a  community  contact,  a  building  inspection,  or  an  emergency  medical 
response.  The  ER  community  needs  to  be  aware  that  it  has  the  “duty  as  assigned”  to  be 
observant  for  “indicators,”  and  then  relay  that  information. 

The  majority  of  recent  attempts  by  radical  jihadist  terrorists  were  the  result  of  a 
domestic  cell.  These  threats  come  in  many  forms,  such  as  radicalized  prisoners, 
homegrown  jihadists  motivated  by  the  al  Qaeda  ideology,  environmental  terrorists,  and  a 
host  of  single-issue  terrorists  such  as  Timothy  McVeigh.  Both  the  federal  partners  and 
the  state  and  local  partners  have  significant  contributions  to  make  toward  providing  for 
the  collective  security  of  the  homeland.  These  partnerships  will  be  optimized  by  personal 
networks  and  collaborative  partnerships  that  reduce  and/or  eliminate  duplication,  and,  by 
relying  on  each  other’s  strengths,  produce  a  far  better  prevention  posture  than  that  which 
could  be  accomplished  independently. 

While  there  are  hundreds  of  thousands  of  law  enforcement  officers  across  the 
country,  we  must  not  be  blinded  to  the  potential  contribution  of  the  rest  of  the  emergency 
responder  community,  particularly  fire,  EMS  and  public  health.  Also,  law  enforcement 
must  overcome  the  bias  that  they  alone  have  the  absolute  responsibility  and  obligation  for 
the  domestic  protection  of  the  nation.  The  fire  service  particularly,  but  also  the  medical 
field,  public  health  and  the  many  other  disciplines  within  the  emergency  responder 
community  possess  a  wide  variety  of  opportunities  for  interaction  and  intelligence 
collection.  It  will  take  more  than  inclusion  by  the  law  enforcement  community  to  exploit 
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these  resources.  The  culture  of  many  of  these  resources  is  geared  toward  patient  privacy 
and  is  counter  to  intelligence  or  information  collection.  This  area  requires  attention  and 
education. 

A.  EMERGENCY  RESPONDERS 

Data  collection  for  emergency  responders  is  an  under-appreciated  and  under¬ 
utilized  resource.  Homeland  Security  strategies  are  resplendent  with  references  for  the 
need  to  have  law  enforcement  and  other  responder  disciplines  collect  information,  but 
there  is  little  concrete  or  readily  available  data  to  show  where  or  how  that  is  being  done. 
That  this  is  important,  there  can  be  little  doubt;  what  is  in  doubt  is  how  to  achieve  this 
end  and  what  results  have  been  garnered  with  what  programs. 

If  one  accepts  the  premise  that  data  collection  for  ERs,  from  either  an  all  crimes 
or  purely  terrorist  (transnational  or  domestic)  perspective  can  support  the  protection  of 
our  country  or  materially  assist  in  a  prevention  mode,  then  one  must  look  to  what 
methods  are  best  utilized  to  collect  this  data.  Law  enforcement  has  the  distinction  of 
generally  having  primacy  in  the  role  of  managing  fusion  centers,  as  well  as  participating 
in  other  aspects  of  the  counterterrorist  effort  on  the  domestic  home  front.  Even  with  that 
perspective,  law  enforcement  still  faces  the  challenge  of  reporting  relevant  information  in 
a  timely  fashion  that  may  lead  to  the  interdiction  or  disruption  of  a  terrorist  act  or  plot. 

To  rectify  the  situation,  the  ER  community  needs  to  be  sold  on  the  value  of  local 
fusion  centers  and  the  value  added  potential  that  they  posses,  as  well  as  the  need  to  be 
observant,  have  sufficient  situational  awareness  to  be  aware  of  what  to  report  and  have 
appropriate  reporting  mechanisms .  A  re-occurring  theme,  that  has  played  itself  out 
several  times,  is  to  create  a  need  amongst  the  emergency  responder  community  that  their 
input  has  value,  and  indeed,  may  be  necessary.  Many  sources  have  cited  terrorism 
fatigue  —  or  the  long  gap  in  time  since  our  last  domestic  attack  —  as  a  potential  causal 
factor  for  the  ER  community  to  be  less  than  diligent  in  their  observations  of  potential 
terrorist  activity  and/or  reporting  it. 
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1. 


Value  of  ER  Data  Collection 


The  results  from  survey  clearly  show  that  fusion  centers  receive  the  majority  of 
their  source  data  from  local  agencies.  The  survey  also  reported  that  80  percent  of  the 
fusion  centers  felt  that  the  ER  community  is  not  being  appropriately  utilized  as  a  data 
source.  FBI’s  Steve  Oda,  LA  RTTAC  co-manager,  supports  these  conclusions  stating  that 
the  value  of  the  ER  data  collection  is  huge  and  that  to  collect  local  ER  data,  the  LA 
RTTAC  utilizes  the  TLO  program,  which  is  a  big  priority  within  the  RTTAC.  Oda  feels 
the  TLO  program  was  very  much  a  work-in-progress  as  were,  probably,  most  others.  He 
believes  that  the  RTTAC  was  undoubtedly  missing  out  on  intelligence  and  that  to  counter 
that  they  are  engaging  in  a  vigorous  education  program,  attempting  to  recruit  and  train 
more  TLOs,  formalizing  the  training,  creating  more  outreach,  particularly  outside  the 
county  of  LA,  and  finally,  redoubling  their  efforts  to  ensure  feedback  to  those  reporting 
information.  One  way  they  have  done  this  has  been  to  assign  every  tip  a  tracking  number 
to  ensure  feedback  and  to  enhance  the  ability  to  connect  follow-up  tips.104 

The  value  of  ER  data  collection  was  also  underscored  in  the  recent  analyst 
training  in  Monterey.  The  group  consensus  of  the  analysts  attending  the  training  was  that 
the  analysts  assigned  to  the  RTTAC  and  the  STTAC  could  not  produce  an  intelligence 
estimate  for  California  because  they  lack  sufficient  threat  data.  One  of  the  key  areas  that 
they  felt  they  were  lacking  was  data  from  the  field.  The  non-reported  incidents  were  felt 
to  be  a  significant  area  that  created  a  hole  in  the  threat  picture.105 

Phil  Bodenhorn,  FBI  FIG  supervisor,  reinforces  the  need  for  first  responders  to 
collect  data  that  he  describes  as  “crucial.”  He  goes  on  to  describe  first  responders  more  as 
“first  preventers”  who  need  to  be  made  aware  of  standing  intelligence  requirements  in 
order  to  maximize  the  opportunity  to  gain  as  much  information  as  possible,  declaiming 
“our  net  work  must  be  theirs.”106 


104  Oda,  interview. 

105  Analyst  Training  Seminar,  Monterey,  California. 

106  Bodenhorn,  interview. 
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2.  Establishing  a  Need 


There  is  the  appearance  of  a  sense  of  complacency  that  has  settled  over  the 
country,  due  in  part  to  the  gap  in  attacks,  and  also,  in  many  respects,  to  the  fact  that  local 
administrators,  and  the  ER  community  as  a  whole,  may  feel  that  a  terrorist  event  will  not 
occur  in  their  jurisdiction.  Even  in  the  law  enforcement  community,  which  is  arguably 
more  prone  to  supporting  and  reporting  terrorist-related  activity,  there  has  been  a  deficit 
in  any  feeling  or  understanding  of  the  need  to  report  terrorist  activity.  In  fact,  many  chief 
executives  of  law  enforcement  agencies  have  expressed  the  desire  for  greater 
intelligence  on  criminal  gang  activity  in  their  jurisdiction  rather  than  that  of  counter¬ 
terrorist  information.107 

That  a  threat  continues  to  exist  is,  as  some  have  called  it,  a  predictable  surprise. 
The  eventuality  of  an  attack  is  almost  certain,  but  the  where  and  the  how  are  unknown. 
This  position  is  supported  by  Brian  Jenkins,  in  his  testimony  before  the  House  of 
Representatives  when  he  said: 

But,  we  have  not  prevented  jihadist  leaders  from  communicating,  blunted 
their  message,  or  effectively  countered  their  ability  to  radicalize  and 
recruit  angry  young  men.  Our  attention  must  the  shift  to  local 
conspiracies,  which  may  operate  below  our  intelligence  radar.  This 
increases  the  importance  of  domestic  intelligence-collection  and  the  role 
of  local  police.108 

To  establish  an  acceptable  level  of  “need”  within  the  ER  community,  homeland 
security  professionals  will  have  to  educate  the  public,  administrators  and  the  ER 
community  without  creating  a  sense  of  fear  or  foreboding.  This  education  should  also 
incorporate  a  realistic  expectation  of  homeland  security  prevention  and  not  entrap  the 
protection  mission  with  the  myth  of  being  able  to  stop  all  attacks.  Everything  is  subject 


107  Police  Executive  Research  Forum,  California  Focus  Group  on  Fusion  Centers  Agency  Fleads 
Meeting,  Norwalk,  California,  August  30,  2007,  Executive  Focus  Group.  Several  of  the  executives  at  this 
meeting  voiced  concern  for  criminal  intelligence,  particularly  gang  intelligence  as  a  greater  need  than 
counterterrorist  intelligence. 

108  Jenkins,  testimony  before  the  Committee  on  Appropriations  Subcommittee  on  Homeland  Security 
United  States  House  of  Representatives,  January  30,  2007,  1. 
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to  prioritization  and  we  cannot  let  terrorists  bankrupt  our  economies  or  our  way  of  life  by 
trying  to  prevent  every  foreseeable  eventuality. 

It  is  also  appropriate  to  recognize  and  address  the  need  for  ER  administrators  to 
enhance  their  information  sharing  and  investigative  capabilities  in  regional  threats  such 
as  gangs,  narcotics,  financial  crimes  and  other  major  types  of  crime  impacting  local 
communities.  Chief  Braziel  expands  on  this  by  offering  known  threats  that  have  a 
regional  base  of  operations  and  are  a  physical  threat  to  the  community.  He  feels  that  a 
regional  and  targeted  gang  analysis,  by  the  fusion  center,  would  generate  a  sense  of  need 
and  involvement  from  the  line-level  law  enforcement  officers  and  their  administrators. 
This  base  of  support  and  success  could  be  used  to  further  counter  terrorist  efforts  by 
demonstrating  a  locally  actionable  product.109 

3.  Situational  Awareness 

One  way  to  demonstrate  the  need  described  above  is  to  educate  elected  officials, 
ER  administrators  and  the  ER  community  on  situational  awareness.  Hand-in-hand  with 
developing  a  need  to  report  is  knowing  what  to  report.  Having  too  much  data  reported 
can  be  as  bad,  and  maybe  worse,  than  not  enough  data.  It  would  be  counter-productive  to 
create  a  suspicious  atmosphere,  in  place  of  an  informed  one,  that  encouraged 
stereotypical  reporting.  Ill-informed  reporting  may  not  only  overwhelm  the  system,  but 
alienate  those  that  have  done  no  wrong,  creating  fear  and  mistrust  in  those  we  want  most 
to  trust  us.  The  ER  community  needs  to  be  educated  about  what  pre-incident  indicators 
are,  with  examples,  and  gain  an  overall  situational  perspective  on  terrorist  operational 
methodology  so  that  they  may  be  alert  for  behavior,  literature,  or  items  of  interest. 

The  vast  majority  of  ERs  will  notice  whether  something  is  amiss;  we  just  need  to 
provide  them  enough  education  to  give  context  or  form  to  what  they  are  seeing.  The 
level  of  education  that  we  are  speaking  about  will  not  require  a  significant  amount  of 
time;  what  is  required  is  enough  information  to  give  the  emergency  responder  community 
confidence  to  report  suspicious  behavior.  The  ER  community,  particularly  the  non  law 


109  Braziel,  interview. 
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enforcement  community,  needs  to  recognize  that  forwarding  a  tip  is  not  an  indictment, 
and  that  no  onus  is  attached  if  an  observation  turns  out  to  be  merely  innocent  behavior. 
Situational  awareness  training  can  be  provided  in  one-day  classes,  seminars,  roll-call 
training  or  online,  and  need  not  be  done  all  at  one  time.  Indeed,  this  education  should  be 
considered  a  perishable  skill  and  refreshed,  perhaps  annually.  The  training  could  be 
reinforced  with  the  use  of  terrorism  liaison  officers,  which  will  be  discussed  below. 

As  has  been  reported  the  evidence  from  the  survey  indicates  that  the  lack  of 
situational  awareness  by  the  ER  community  is  a  problem.  Lt.  Johnstone,  Sacramento 
RTTAC  commanders’  observations  on  his  assessment  of  the  regions  situational 
awareness  are  evident  in  his  comment:  the  situational  awareness  for  law  enforcement  is  at 
a  bare-bones  level.  And  it's  even  worse  for  the  emergency  responder  community.110 

4.  Reporting  Mechanism 

It  is  interesting  to  note  that  the  responders  to  the  survey  stated  that  reporting 
mechanisms  are  available  and  user-friendly,  and  that  there  is  potentially  valuable 
information  residing  in  the  ER  community,  but  that  the  ER  community  seems  to  be 
failing  to  take  advantage  of  reporting  opportunities.  It  is  quite  possible  that  the  reporting 
system  is  not  as  user-friendly,  available  or  widely  known  as  the  fusion  center  managers 
had  hoped.  (It  is  also  likely  that  poor  situational  awareness  has  contributed  to  the  under¬ 
reporting). 

Once  a  member  of  the  ER  community  has  infonnation  that  he  or  she  feels  should 
be  reported,  he  or  she  can  use  one  of  several  methods  to  report  potential  terrorist  activity. 
Currently,  most  tips  can  be  reported  on  800  numbers,  fusion  center-sponsored  websites, 
terrorism  liaison  officers  (if  one  exists  in  your  agency),  a  terrorism  early  warning  group 
(if  one  is  available  to  you),  via  the  nonnal  reporting  procedure  in  your  local  law 
enforcement  agency,  or  directly  to  any  FBI  field  office  or  agent. 

Due  to  the  specialized  nature  of  terrorism,  many  of  the  earlier  versions  or  methods 
of  reporting  terrorism  were  conducted  along  the  lines  of  social  networks.  While  social 

110Johnstone,  interview. 
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networks  are  critical,  they  need  to  be  bolstered  with  sufficient  technology  to  ensure  rapid 
and  seamless  reporting  that  does  not  rely  on  an  individual,  which  may  become  a  single 
point  of  failure  in  the  reporting  chain.  During  the  course  of  conducting  interviews  for 
this  thesis,  it  was  reported  that  a  tip  from  a  TLO  was  left  on  a  desk  and  was  not  acted  on 
until  after  the  subject,  who  was  on  a  watch  list,  left  the  country. 

Two  of  the  fusion  centers,  the  Los  Angeles  JRIC  (RTTAC)  and  the  Northern 
California  RTTAC  both  have  websites  that  have  a  link  to  a  tip  and  lead  fonn  that  can  be 
filled  out  online  and  sent  in  to  the  fusion  center.  This  method  appears  to  be  working  well 
and  has  great  promise  and  capability,  including  the  capability  for  the  public  to  send  in 
tips  or  leads.  One  problem  with  this  is  that  the  local  TLO  officer  will  very  likely  not 
have  any  infonnation  on  activity  that  may  be  happening  and  reported  on  in  his  or  her  area 
of  responsibility. 

The  Sacramento  RTTAC  currently  uses  the  TLO  program  as  their  primary  means 
of  conducting  education  and  awareness  about  the  program,  as  well  as  relaying  tips  and 
leads  from  the  field  to  the  fusion  center.  One  problem  with  this  is,  as  stated  above,  this 
can  create  a  single  point  of  failure.  If  the  TLO  that  the  officers  are  used  to  working  with 
is  on  vacation,  takes  days  off,  or  transfers,  that  information  may  not  be  relayed  in  a 
timely  fashion,  or  at  all.  The  Sacramento  RTTAC  is  exploring  a  website  reporting 
systems  similar  to  the  Northern  California  and  the  LA  RTTAC’s  system. 

Another  problem  common  to  most  reporting  mechanisms  is  how  does  one  report 
suspicious  activity  to  one's  own  investigative  unit  as  well  as  to  the  fusion  center?  If  the 
tip  is  not  obviously  terrorism,  merely  suspicious,  but  is  clearly  a  violation  of  the  law,  a 
financial  crime  for  example,  how  would  one  report  that  information  so  that  both  agencies 
remain  aware  of  the  potential  crime?  Also,  how  does  one  remove  the  conflict  for  the 
potential  for  duplication  of  investigations  and  interfering  with  each  other's  investigation? 
An  additional  problem  is  that  law  enforcement  officers  and  others  in  the  ER  community 
may  reduce  their  level  of  reporting  if  they  have  to  report  the  same  information  multiple 
times  to  different  entities. 
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Closing  the  loop  on  reporting  tips  and  leads  to  the  RTTAC  is  feedback  from  the 
RTTAC  to  the  tipster.  Each  of  the  RTTAC  commanders  that  were  interviewed  felt 
strongly  about  getting  feedback  to  the  emergency  responder  (generally  fire  or  law)  that 
made  the  referral.  While  not  all  had  a  fonnal  process,  it  was  a  matter  of  standard 
operating  procedure  to  acknowledge  those  who  provided  infonnation.  The  LA  RTTAC 
has  a  unit  whose  responsibility  it  is  to  perfonn  this  function,  the  Investigative  Liaison 
Unit.  The  LA  RTTAC  also  publishes  a  weekly  “Tips  and  Leads”  sheet  that  shows  what 
tips  have  come  in  as  a  way  to  share  information  and  generate  interest,  as  well  as 
acknowledgement. 1 1 1 

B.  DATA  COLLECTION 

1.  Terrorism  Liaison  Officer  (TLO)  Programs 

If  fusion  centers  are  to  operate  as  effectively  as  they  can,  they  will  need  to  have 
timely  data  that  is  collected  locally.  One  method  would  be  to  use  the  law  enforcement  or 
emergency  responder  community  as  data  collectors.  That  raises  the  question:  How  do 
you  train  an  entire  police  force,  nationwide,  on  pre-incident  indicators?  How  do  you  keep 
those  perishable  skills  current  in  an  environment  that  will  rarely  allow  the  officer  to 
practice  what  he  or  she  has  been  taught?  One  answer  is  the  TLO  program,  which 
provides  for  a  few  officers  to  receive  in-depth  and  recurring  training  to  function  as  a 
resource  or  a  point  of  contact  for  other  officers  in  his  or  her  department. 

a.  Overview  of  Sacramento  RTTAC  TLOs 

The  Sacramento  Regional  Office  of  Homeland  Security  (SROHS)  and  the 
Sacramento  RTTAC  facilitated  a  forty-hour  training  course  for  TLOs  within  the  RTTACs 
region  (34  counties  &  88,000  square  miles)  that  hundreds  of  officers  attended.  One  year 
after  the  program,  the  RTTAC  was  still  receiving  a  minimal  number  of  tips  or  leads  from 
the  officers  that  had  undergone  the  training.  A  complete  review  of  the  training  and 
program  was  conducted.  The  training  course  itself  was  judged  to  be  superior  (although 

1 1 1  Galarneau,  interview. 
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some  modest  changes  were  made  to  the  course).  The  training  program  consisted  of  a  five- 
day  overview  and  situational  awareness  of  domestic  and  transnational  terrorist 
methodologies  and  ideology.  The  course  content  was  thorough,  well  received  and  well 
rated. 

An  objective  review  of  the  program  revealed  several  shortcomings.  First, 
the  TLO  training  was  rolled  out  ahead  of  the  TLO  program  itself.  Secondly,  agency 
administrators  within  the  RTTAC  region  were  largely  unaware  of  the  program,  did  not 
know  the  benefits  of  the  program  or  what  the  expectation  for  their  participation  might  be, 
or,  what  level  of  commitment  would  be  expected.  Third,  the  training  was  announced  via 
the  nonnal  training  announcement  system,  and  officers  self-selected  to  go  to  the  training 
without  administrative  support  or  time  commitments.  Fourth,  what  was  not  included  in 
the  curriculum  was  how  the  TLOs  were  to  operate  within  their  own  agencies  or  in 
relation  to  the  RTTAC.  What  had  been  done  gave  the  officers  a  fine  orientation  on 
terrorism  and  then  sent  them  back  to  their  agencies  without  adequate  support  or 
operational  instruction.  According  to  Tim  Johnstone,  the  RTTAC  Commander,  training 
had  been  provided  to  475  TLOs  without  adequate  forethought,  as  a  knee  jerk  response  to 
the  need  to  provide  and  collect  intelligence.  A  re-organization  was  in  order. 

The  Sacramento  RTTAC  collaborated  with  the  U.S.  Attorney's  Office 
training  coordinator  for  the  U.  S.  Eastern  District  for  California,  Jim  Day.  Jim  Day  had 
spent  the  majority  of  his  career  in  the  thirty-four  counties  of  the  RTTAC  jurisdiction  and 
knew  almost  every  chief  of  police  and  sheriff  in  that  region.  With  his  assistance,  the 
RTTAC,  represented  by  Lt.  Tim  Johnstone,  Sergeant  Greg  Ladas,  and  Jim  Day  scheduled 
appointments  to  meet  with  the  chiefs  of  police  and  sheriffs  in  virtually  every  jurisdiction 
within  thirty-four  counties  to  explain  the  program,  its  potential  benefits  and  the  level  of 
commitment  (which  was  minimal)  that  would  be  required  for  their  agency  to  participate. 
Because  of  this  level  of  personal  outreach,  the  program  was  well  received  and  a  much 
greater  degree  of  commitment  and  involvement  was  gained  from  the  law  enforcement 
executives.  The  head  of  each  law  enforcement  agency  that  was  participating  in  the  TLO 
program  was  asked  to  nominate  a  candidate.  This  way,  it  was  felt,  the  TLO  program 
would  have  a  greater  buy-in  from  the  agencies,  since  they  had  a  direct  hand  in  selecting 
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the  personnel  that  would  become  the  TLO  officers  and  represent  their  agency.  And, 
perhaps  more  importantly,  it  was  expected  that  agency  heads  would  nominate  a  candidate 
that  they  had  confidence  in,  and  they  would  be  able  to  fulfill  the  role  of  liaison  to  the 
agency's  administrators,  in  addition  to  acting  as  a  point  of  contact  and  reference  for  front¬ 
line  officers.  In  support  of  this,  Greg  Ladas  stated  that  agency  heads  would  often  say 
something  similar  to:  I  didn’t  know  this  person  was  a  TLO;  he  is  not  a  good  fit  for  our 
agency.  Once  personal  contact  was  made,  and  expectations  and  commitments  were  made 
clear,  the  program  support  increased  appreciably. 

The  original  TLO  training  course  was  forty  hours.  The  course  was 
shortened  to  twenty-four  hours  and  a  separate,  stand-alone  one-day  course  was  added  to 
the  program.  The  one-day  course  consisted  of  an  orientation  to  the  TLO  program  and  it 
trained  the  officers  on  how  to  function  as  a  TLO.  The  roles  and  responsibilities  of  the 
position  were  outlined  and  they  were  given  guidance  in  how  to  liaison  with  their 
administrators,  how  to  interact  with  the  line  level  officers,  and  how  to  interact  with  the 
RTTAC.  The  TLOs  received  training  in  the  handling  of  sensitive  infonnation  and  in 
reporting  tips  and  leads.  The  role  of  the  Sacramento  TLO  was  to  be  a  point  of  contact 
and  a  resource  for  the  line  officers,  conduct  roll  call  training,  be  a  conduit  to  relay  tips 
and  leads  from  the  officers  to  the  TLO  coordinator  (who  in  turn  relays  that  infonnation  to 
the  RTTAC),  and  act  as  a  liaison  to  their  agency  in  matters  regarding  terrorism.  Prior  to 
the  training,  the  RTTAC  had  sent  out  a  form  for  each  agency  executive  to  nominate  the 
TLO;  these  had  to  be  provided  to  RTTAC  at  the  time  of  TLO  training.  The  TLOs  were 
also  required  to  sign  a  nondisclosure  agreement  stating  that  they  would  handle  the  FOUO 
and  Law  Enforcement  Sensitive  (LES)  infonnation  as  had  been  instructed  in  class. 

The  reporting  system  for  tips  and  leads  in  the  Sacramento  RTTAC 
consists  of  officers  or  line-level  personnel  who  discover  information  that  does  not  require 
an  immediate  response  to  report  that  information  to  the  TLO.  (Each  county  will  have  at 
least  one  TLO  coordinator  and  several  TLOs).  The  TLO  will  report  tips  and  leads  to  the 
TLO  coordinator  who  will  then  relay  that  information  to  the  RTTAC. 

TLOs  were  also  encouraged  to  establish  terrorism  early-warning  groups 

(TEWG)  within  their  counties.  They  received  basic  information  on  the  TEWG  concept, 
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with  more  training  scheduled  for  the  future.  TLOs  were  also  encouraged  to  attend,  and 
offered  priority  reservations,  for  training  in  the  Automated  Critical  Asset  Management 
System  (ACAMS)  and  the  Enhanced  Threat  and  Risk  Assessment  (ETRA)  class.  Once 
the  TLOs  receive  this  training,  they  will  be  encouraged  to  conduct  ACAMS  assessments 
in  their  jurisdictions  on  critical  infrastructure.  The  RTTAC  maintains  a  list  of  critical 
infrastructure  locations  that  will  help  TLOs  identify  and  prioritize  sites  that  need 
assessments. 

The  Sacramento  RTTAC  TLO  program  is  approximately  six  months  into 
this  re-organization.  While  the  program  still  has  some  hurdles  to  overcome,  there  has 
been  a  noticeable  increase,  not  only  in  the  quality,  but  in  the  quantity  of  tips  and  leads.112 

The  Sacramento  RTTAC  has  a  re-vitalized  Fire  TLO  program  underway 
as  well.  Sacramento  Metro  Fire  Bn  Chief  Mark  Wells  and  Captain  Scott  Cockrum  have 
formed  a  working  group  to  determine  what  information  fire  administrators  and 
firefighters  need,  and  how  best  to  relay  that  information.  The  group  is  also  developing  a 
reporting  format  for  firefighters  to  forward  tips  and  leads  to  the  RTTAC.  Currently,  the 
system  is  informal  and  handled  on  a  case-by-case  basis.  By  involving  the  fire  community 
in  identifying  their  own  needs  and  procedures,  a  greater  degree  of  involvement  and 
support  is  anticipated.  They  are  also  reviewing  the  consumption  potential  for  the 
firefighters  and  administrators.  At  what  rate,  and  how  much  intelligence  is  needed,  and 
how  will  it  best  be  assimilated  are  the  issues  they  are  dealing  with.113  Most  fire 
departments  also  have  HIPPA  issues,  as  many  of  their  personnel  are  also  EMS  and  have 
additional  reporting  restrictions  (which  will  be  discussed  below). 


112  Personal  communication  throughout  most  of  2007  with  RTTAC  Commander  Tim  Johnstone,  TLO 
coordinator  Greg  Ladas,  Metro  Fire  Captain  Scott  Cockrum,  and  U.S.  Attorney  training  coordinator  Jim 
Day. 

113  Mark  Wells,  Bn,  Chief  Sacramento  Metro  Fire  Department,  TLO  Coordinator,  interview, 
December  20,  2007. 
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The  Public  Health  Department,  which  has  representatives  co-located  in  the 
same  facility  as  the  RTTAC,  is  in  the  very  beginning  stages  of  developing  a  TLO 
program  in  the  public  health  EMS/medical  field.  This  program  will  establish  a  TEWG 
within  the  public  health/medical  community. 

One  of  the  identified  shortcomings  of  the  Sacramento  TLO  program  is  the 
reliance  on  the  TLOs  as  a  conduit  for  the  tips  and  leads  from  the  officers  making 
observations  to  the  TLO  coordinator  and  to  the  RTTAC.  First,  information  is  fourth  hand 
by  the  time  it  gets  to  the  RTTAC.  Secondly,  the  reporting  system  is  a  single  chain  of 
individuals  with  no  redundant  or  back-up  reporting  mechanism.  Any  point  in  the  chain 
could  be  a  point  of  failure  and  the  infonnation  would  not  be  received.  In  the  event  a  TLO 
or  TLO  coordinator  was  on  vacation,  had  days  off,  was  unmotivated  or  overloaded  with 
other  duties,  the  potential  for  a  tip  or  lead  to  be  delayed,  misplaced  or  simply  not 
forwarded  is  quite  likely.  Third,  turnover  of  TLOs,  due  to  rotation  of  assignments  and 
promotions,  will  make  it  difficult  for  the  line  officers  to  know  exactly  who  their  TLO  is 
at  any  given  time.  The  turnover  issue  will  also  make  it  difficult  to  keep  an  adequate 
number  of  TLOs  to  facilitate  the  unimpeded  flow  of  information. 

A  recognized  potential  solution  would  be  a  web-based  reporting  system 
similar  to  that  which  the  Los  Angeles  RTTAC  (LA  JRIC)  and  the  Bay  Area  RTTAC 
currently  use.  Both  systems  are  widely  available,  not  only  to  the  ER  community,  but  also 
to  the  public,  and  are  quite  simple  to  use. 

b.  Overview  of  the  LA  TLO  Program 

The  Los  Angeles  TLO  program  is  operated  out  of  the  LA  RTTAC  or  the 
LA  JRIC  (the  LA  fusion  center  was  originally  called  the  Joint  Regional  Intelligence 
Center,  JRIC  and  the  terms  have  become  synonymous).  Prior  to  the  TLO  program, 
information- sharing  relating  to  terrorism  was  conducted  on  a  personal  relationship  one- 
to-one  basis,  which  is  clearly  not  efficient  in  a  jurisdiction  the  size  and  complexity  of  Los 
Angeles.  The  TLO  program  has  expanded  from  Los  Angeles  County  to  include  a  total  of 
seven  counties;  in  addition  to  LA  County,  the  RTTAC  represents  Orange  County,  Santa 
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Barbara  County,  Riverside  County,  San  Bernardino  County,  San  Luis  Obispo  County, 
and  Ventura  County.  There  are  over  200  TLOs  in  the  Los  Angeles  PD  and  Los  Angeles 
County  Sheriffs  Department.  The  LA  RTTAC  supports  approximately  500  TLOs. 

With  only  one  law  enforcement  TLO  coordinator  for  the  entire  RTTAC, 
individual  personal  contact  is  severely  limited  and  restricts  the  role  of  the  LA  RTTAC  TLO 
coordinator  from  facilitator  to  one  of  administrator.  This  lack  of  personal  contact  is  being 
mitigated  by  establishing  lead  TLOs  for  each  of  the  eight  mutual  aid  regions  within  the 
jurisdiction  of  the  RTTAC  to  act  as  local  coordinators.  Each  county  within  the  RTTAC  has 
also  designated  TLO  coordinators  to  facilitate  the  program.  These  TLO  coordinators 
facilitate  the  program  and  give  local  agencies  a  local  contact  that  is  seen  as  one  of  their  own 
and  not  a  remote  figure  from  a  “parent”  agency.  The  dissemination  of  information  from  the 
RTTAC  to  the  TLO  is  conducted  via  e-mail  groups.  It  is  the  responsibility  of  each  individual 
TLO  to  serve  as  a  point  of  contact  and/or  reference  to  officers  in  his  or  her  department. 
Reporting  back  to  the  RTTAC  is  done  via  the  website  www.tlo.org.  The  website  has 
graduated  access  from  public  domain  to  restricted  to  TLOs  requiring  a  log-in.  There  is  also  a 
link  for  public  reporting.  1 14 

To  minimize  any  potential  loss  of  intelligence,  the  LA  RTTAC  has  tried  to 
establish  TLOs  in  most  significant  investigative  units,  generally  the  detective  sergeant  or  the 
lead  detective.  The  intent  is  that  as  they  review  incoming  reports,  they  can  make  note  of 
information  that  may  be  relevant  to  the  RTTAC  and  forward  that  information.^^  As  with 
many  other  agencies,  and  exacerbated  in  a  program  the  size  of  LA’s,  maintaining  a 
knowledgeable  and  trained  cadre  of  TLOs  will  be  an  ongoing  challenge.  The  turnover  and 
lack  of  training  was  apparent  in  a  forum  sponsored  by  the  Police  Executive  Research  Forum 
at  the  LA  RTTAC,  which  was  attended  by  TLOs  in  the  LA  region.  Many  of  the 


114  Pete  Jackson,  Sergeant,  LA  County  Sheriffs  Department,  LA  RTTAC  TLO  Coordinator, 
interview,  December  3,  2007. 

H5  Galarneau,  interview.  The  overview  of  the  LA  TLO  program  is  based  on  the  interview  with  LA 
RTTAC  co-manager  Robert  Galarneau  and  LA  RTTAC  TLO  manager  Pete  Jackson. 
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TLOs  that  attended  the  meeting  had  not  yet  received  any  specialized  training  and  several 
TLOs  had  just  been  given  the  job  with  very  little  understanding  of  what  the  job  was  or  how  to 
do  it.  11 6 


c.  Overview  of  the  Northern  California  (NC)  TLO  Program 

The  Northern  California  (Greater  San  Francisco  Bay  Area)  TLO  program 
is  organized  in  a  fashion  similar  to  the  LA  and  Sacramento  programs.  In  the  NC  TLO 
program,  officers  volunteer  for  the  position  and  get  approval  from  their  chain  of 
command.  Briefing  information  and  bulletins  are  made  by  way  of  postings  to  their 
website,  which  requires  a  log-on  for  different  levels  of  access.  The  website, 
www.ncrttac.org,  also  serves  as  a  reporting  mechanism  for  tips  and  leads  from  the  TLOs 
as  well  as  the  public.  However,  the  NC  RTTAC  TLOs  do  not  receive  bulletins  or 
briefing  information  via  e-mail  as  San  Francisco  police  officers  do  not  have  e-mail 
accounts.  In  order  to  mitigate  this  obstacle,  the  NC  RTTAC  utilizes  an  alerting  network, 
Roam  Secure  alert  network.  This  commercial  system  sends  out  paging  notifications  on 
emerging  events  or  other  bulletins. 

The  NC  RTTAC  is  experiencing  the  same  problem  with  TLO  turnover  as 
the  other  jurisdictions.  They  are  finding  a  need  to  constantly  train  TLOs.  The  RTTAC, 
according  to  Commander  Mike  Sena,  feels  that  they  are  losing  information  as  there  are 
break-downs  in  the  system,  particularly  with  so  many  different  responder  jurisdictions 
and  disciplines,  each  with  their  own  distinct  cultures. 

The  role  of  the  NC  RTTAC  TLO  is  to  act  as  an  intelligence  liaison  officer; 
the  goal  is  to  create  informant  networks.  Getting  the  ER  community  to  respond  has  been 
slow  but  it  is  a  necessary  task.  Sena  feels  that  the  lack  of  recent  successful  attacks  has 
minimized  the  priority  for  observance  and  reporting  in  the  mind  of  the  public  and  the  ER 
community,  stating,  “We  need  to  educate  without  terrifying  them.”117 


1111  Police  Executive  Research  Forum,  personal  observation. 

1 1 7  The  overview  of  the  NC  TLO  program  is  based  on  the  interview  with  the  RTTAC  commander 
Mike  Sena. 
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d.  Overview  of  the  San  Diego  TLO  Program 

The  San  Diego  TLO  program  falls  under  the  purview  of  the  RTTAC  along 
with  critical  infrastructure  protection  and  analytical  strategic  support  for  the  region.  The 
program  is  currently  under  reorganization.  A  year  ago,  the  program  was  very  disjointed 
and  not  very  well  structured.  The  San  Diego  RTTAC  is  now  assuming  responsibility  for 
organizing  the  program  and  is  focusing  first  on  law  enforcement,  and  will  then  direct  its 
efforts  toward  fire,  EMS,  public  health  and  finally,  the  public  sector.  Virtually  every  law 
enforcement  agency  in  the  San  Diego  RTTAC  jurisdiction  has  a  representative  in  the 
TLO  program. 

One  of  the  main  functions  of  the  RTTAC  is  to  support  the  TLO  program 
and  the  TLOs.  This  support  is  in  the  form  of  providing  information  and  intelligence  to 
the  TLO  officers  who,  in  turn,  are  expected  to  provide  that  information  to  the  officers 
within  his  or  her  department.  Information  comes  in  the  fonn  of  bulletins  with  specific 
information  and  strategic  pieces  of  intelligence  that  describe  trends  and  more  generalized 
intelligence. 

TLOs  are  not  expected  to  be  investigators  or  even  infonnation  collectors 
per  se,  but  are  expected  to  “push  and  pull”  infonnation  between  the  field  and  the 
RTTAC.  Their  role  is  to  be  the  facilitators  of  the  program  demonstrating  a  need  to 
collect  information,  and  to  operate  as  a  point  of  contact  or  reference  for  officers  in  the 
field  needing  extra  information  or  guidance.  Currently,  all  tips  and  leads  go  directly  to 
the  Joint  Tenorism  Task  Force  (JTTF).  The  JTTF  has  a  link  on  most  departments’ 
interdepartmental  websites  and  also  has  the  ability  to  receive  information  by  phone. 

Once  the  TLO  program  is  stabilized  in  the  law  enforcement  community, 
the  intention  of  the  RTTAC  is  to  extend  the  program  to  the  other  emergency  responder 
communities.118 


118  The  overview  of  the  San  Diego  TLO  program  is  based  on  the  interview  with  San  Diego  RTTAC 
commander  Lee  Yoder,  December  10,  2007. 
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e.  Overview  of  the  Arizona  TLO  Program 

The  Arizona  TLO  program  is  a  much  more  robust  and  involved  program 
than  the  others  that  have  been  described  heretofore.  There  are  two  levels  of  TLO  in 
Arizona  and  they  receive  different  levels  of  training,  equipment  and  support.  Level  A 
TLOs  receive  a  vehicle,  a  phone  and  a  laptop  computer  with  secure  connectivity 
equipment  and  are  required  to  dedicate  forty  hours  a  month  to  the  program.  Level  B 
TLOs  receive  the  same  equipment  but  no  vehicle.  They  are  required  to  contribute  twenty 
hours  a  month  to  the  program. 

Both  levels  of  TLO  are  responders  with  a  mandate  to  respond  to  any  major 
fire  or  law  incident  and  perform  the  intelligence  branch  function  in  the  Incident 
Command  System  (ICS).  This  system  has  been  in  operation  for  three  years  and  it  has 
been  one  of  the  best  marketing  tools  for  the  TLO  program.  Local  emergency  responders 
are  able  to  regularly  see  the  value  of  the  TLOs  as  they  provide  on-scene  connectivity  and 
intelligence.  There  were  212  TLOs  in  Arizona  at  last  count.  They  are  dispersed 
throughout  Arizona  and  respond  to  major  incidents,  terrorist  or  otherwise,  and  act  as  a 
liaison  to  the  Arizona  Counter  Terrorism  Information  Center.  A  significant  amount  of 
their  response  capability  is  geared  toward  incidents  or  crimes  other  than  terrorism. 
However,  they  are  always  observant  of  any  nexus  to  potential  terrorist  activity.  In 
addition,  by  making  themselves  useful,  they  have  created  social  networks  that  have 
encouraged  information  sharing,  which  will  enhance  their  ability  to  receive  and  pass  on 
information.  Finally,  they  are  delivering  an  immediate  and  observable  service  to  the 
emergency  responder  community  within  which  they  operate.119 


119  The  overview  of  the  Arizona  TLO  program  is  based  on  the  interview  with  Norman  Beasley. 
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2. 


Terrorism  Early  Warning  Groups  (TEWG) 


Terrorism  early  warning  groups,  as  originally  conceived  in  the  Los  Angeles 
model120  have,  for  all  practical  intents  and  purposes,  been  subsumed  by  the  RTTACs  or 
the  State  Terrorism  Threat  Assessment  System.  A  more  basic  and  perhaps  more 
commonly  used  version  of  the  TEWG,  and  one  that  is  used  by  the  Sacramento  RTTAC, 
is  the  identification  of  terrorism  early-warning  groups  as  communities  of  specialized 
knowledge  or  interest  that  may  be  in  a  position  to  make  observations  of  potential  terrorist 
activity  or  be  the  subject  of  interest  from  terrorist  groups.  The  Sacramento  RTTAC  uses 
liaison  officers  as  a  conduit  between  the  “group”  and  the  RTTAC.  In  the  case  of  the 
more  traditional  ER  communities,  the  liaison  officers  are  referred  to  as  terrorism  liaison 
officers  (TLOs),  which  generally  liaise  with  members  of  their  own  organization,  in  either 
law  enforcement  or  fire.  However,  TLOs  are  being  encouraged  to  develop  TEWGs  in 
their  geographic  area  of  responsibility  with  groups  that  they  and  their  local  administrators 
deem  appropriate. 

One  group,  that  the  Sacramento  RTTAC  is  currently  in  the  process  of  establishing 
a  TEWG  and  TLOs  with,  is  the  public  health  department,  which  will  be  expanded  to  the 
larger  medical  community.  There  are  an  infinite  number  of  groups  that  could  be  created 
as  terrorism  early-warning  groups,  such  as  public  works,  non-law  enforcement 
government  agencies,  postal  workers,  schools,  agriculture,  community  organizations,  and 
the  private  sector,  particularly  those  that  have  vulnerability  or  may  be  at  risk  for  a 
potential  terrorist  attack. 

An  additional  group  that  the  Sacramento  RTTAC  is  developing  as  a  terrorism 
early  warning  group  collaborates  with  the  FBI's  InfraGard121  program.  InfraGard  is  an 
association  of  private  sector  companies  that  share  information  regarding  threats, 
vulnerabilities  and  mitigation  strategies,  which  is  run  by  the  FBI.  Because  membership 


120  The  Los  Angeles  terrorism  early-warning  group  has  been  written  about  extensively  and  there  are 
numerous  excellent  sources  for  further  reference.  John  Sullivan,  the  acknowledged  architect  of  the  TEW 
concept  has  written  any  number  of  articles. 

121  For  more  information  on  InfraGard,  see  their  website  at  http://www.infragard.net/. 
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in  the  organization  requires  a  limited  background  check,  members  are  allowed  to  receive 
Law  Enforcement  Sensitive  (LES)  bulletins.  The  Los  Angeles  and  the  Sacramento 
Infraguard  organizations  were  reported  to  be  robust  and  beneficial  to  the  respective 
RTTACs.122 

The  Sacramento  RTTAC  is  encouraging  all  of  the  TLOs  in  its  thirty-four  counties 
to  establish  TEWGs  in  their  respective  jurisdictions.  The  type  and  number  of  TEWGs 
each  TLO  establishes  will  be  dependent  on  the  threat  picture  in  that  jurisdiction,  the 
infrastructure  that  may  be  at  risk,  and  the  availability  of  groups  of  interest  that  may  be  of 
value  in  collecting  potentially  useful  intelligence.  Each  county  will  be  able  to  assess  for 
itself  the  needs  of  its  particular  jurisdiction,  as  well  as  its  capability  to  establish 
relationships  and  act  as  conduits  of  information  between  the  TEWG  and  the  RTTAC. 

Once  the  TEWG  is  established,  separate  group  lists  can  be  created  to  disseminate 
relevant  information  to  different  groups  via  e-mail.  The  bias  should  be  a  need  to  share 
while  protecting  any  necessary  confidentiality.  The  TLO  will  also  have  to  establish  an 
effective  reporting  mechanism.  Members  of  the  TEWG  will  need  to  realize  some  benefit 
for  their  participation  and  this  will  most  likely  come  in  the  form  of  information  that  is 
exchanged  between  members,  the  TLO  and  the  RTTAC.  This  may  require  the  TLO  to 
go  to  the  group  to  give  presentations  and  assist  in  security  assessments,  AC  AMS,  or  other 
types  of  awareness  training. 

The  LA  RTTAC  and  the  NC  RTTAC  have  extensive  standing  TEWGs  within 
their  jurisdictions.  Some  terrorism  early-warning  groups  have  their  own  analytical  and 
dissemination  systems  such  as  the  East  Bay  terrorism  early  warning  group.  A  concern 
here  is  the  potential  for  stove-piping  and  duplication  of  efforts.123 

For  fusion  centers  that  are  strictly  counterterrorism,  it  is  very  important  to 
establish  a  TEWG  with  each  of  the  multiple  investigative  units  in  their  area  of 
responsibility  so  that  they  can  be  apprised  of  information  of  interest  as  it  develops.  One 


122  Fusion  Analyst  Training  Conference,  Monterey,  California,  January  23,  2008,  personal 
communication. 

123  Sena,  interview. 
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way  for  the  law  enforcement  community  to  gain  infonnation  from  the  investigators,  or 
from  law  enforcement  in  general,  is  to  establish  terrorism  early-warning  groups  with 
liaisons  from  members  of  each  of  the  significant  investigative  groups  from  each  of  the 
major  jurisdictions.  For  example,  the  financial  crimes  unit,  or  the  gang  unit,  should  have 
liaisons  with  the  fusion  centers.  In  this  way,  if  an  investigative  unit  is  working  a  case  and 
it  seems  that  there  is  some  potential  terrorist  nexus,  the  terrorism  early-warning  group 
liaison  officer  should  relay  that  information  to  the  fusion  center.  This  is  essentially  the 
role  of  a  TLO.  Correspondingly,  if  the  fusion  center  receives  infonnation  that  may  be 
tenorism,  and  initial  investigation  determines  it  to  be  purely  criminal,  then  it  should  be 
the  obligation  of  the  fusion  center  to  relay  that  information  to  the  appropriate 
investigative  unit  via  the  same  liaison  officer  or  other  method. 

3.  Special  Considerations  for  Other  ER  Communities 

It  has  been  widely  held  and  acknowledged  that  America’s  emergency  responders 
have  a  great  capacity  for  interacting  with  the  public  they  serve  much  more  intimately  than 
their  federal  counterparts  interact.  What  has  been  less  well  understood,  until  recently,  is 
their  potential  for  contribution  to  the  counterterrorism  effort.  Engaging  the  emergency 
responder  community  will  take  outreach,  education  and  networking.  Most  of  the  ER 
disciplines  will  need  the  same  education  as  law  enforcement  on  developing  a  need, 
demonstrating  value,  providing  situational  awareness  and  making  reporting  accessible. 
As  many  areas  are  just  getting  their  law  enforcement  agencies  oriented  to  providing  tips 
and  leads,  it  is  understandable  that  engaging  the  other  disciplines  has  not  been  fully 
engaged  or,  in  some  cases,  even  appreciably  underway.  It  will  be  prudent,  though,  to 
ensure  that  steps  are  taken  to  include  the  input  from  the  rest  of  the  ER  community. 

Engaging  the  medically  oriented  responder  disciplines  is  an  area  that  needs 
further  study  and  attention.  The  greater  medical  community  consisting  of  fire, 
Emergency  Medical  Services  (EMS),  public  health  and  medical  facilities,  are  not 
normally  disposed  to  reporting  suspicious  behavior.  They  are  mandatory  reporters,  by 
law,  for  certain  specified  crimes,  but  it  requires  the  force  of  law  to  gain  compliance.  To 
get  the  medical  community  to  observe  and  report  on  suspicious  behavior  will  be  difficult, 
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but  it  is  a  worthwhile  endeavor.  It  will  require  a  substantial  amount  of  education  to 
convince  this  community  of  the  need  and  value  of  reporting.  Even  more  education  will 
be  required  to  make  them  comfortable  with  the  ethics  and  legalities  of  reporting. 

This  is  even  more  so  with  EMS,  which  does  not  have  mandatory  reporting 
requirements  and  is  even  prevented  from  some  types  of  reporting  (in  California).  EMS 
personnel  respond  to  the  scene  of  the  incident  and  are  in  a  position  to  see  not  only  the 
victim,  but  the  environment  that  created  the  injury,  often  before  it  has  been  sanitized. 
The  rules  for  EMS  reporting  medical  information  on  suspicious  incidents  are  very 
restrictive,  even  more  so  than  for  doctors  or  other  medical  personnel.  However,  EMS  can 
report  on  what  Petrie  describes  as  “incident  indicators”  but  can  not  report  medical 
information.  There  is  great  value  in  having  EMS  report  incident  indicators  but  the 
distinction  requires  education  and  the  legal  ramifications  will  make  many,  if  not  most, 
EMS  personnel  uncomfortable.124  The  ethical  considerations  will  exacerbate  the 
reporting  reluctance  as  well  as  the  disinclination  of  many  of  the  helping  professions  to 
“intrude”  in  a  patient’s  privacy.  With  that  said,  the  potential  for  useful  information 
makes  the  effort  worthwhile  and  justifies  the  reporting  attempts. 

4.  Community-Oriented  Policing 

One  commonly  agreed  method  of  prevention  is  the  need  for  intelligence. 
Intelligence  is  a  derivative  of  information,  and  one  of  the  best  sources  of  information  for 
domestic  counterintelligence  is,  arguably,  Human  Intelligence  (HUMINT).  A  potential 
source  of  human  intelligence  is  Community  Oriented  Policing  (COP);  however,  this  has 
proven  to  be  an  under-utilized  tool.  To  support  this,  the  survey  data  reported  that  60 
percent  of  the  fusion  centers  stated  that  they  received  less  than  5  percent  of  tips  and  leads 
from  COP  efforts,  with  an  additional  20  percent  stating  they  received  5  to  10  percent  of 


124  Michael  Petrie,  “The  Use  of  EMS  Personnel  as  Intelligence  Sensors:  Critical  Issues  and 
Recommended  Practices,”  Homeland  Security  Affairs  III,  no.  3  (September  2007), 
http://www.hsaj.org/7articleAI. 3. 6,  Last  accessed  February  11,  2008.  This  is  a  very  brief  comment  on 
Petrie’s  article.  I  would  strongly  recommend  anyone  developing  an  EMS  TLO  or  similar  reporting 
program  to  read  Petrie’s  article  the  Use  of  EMS  Personnel  as  Intelligence  Sensors:  Critical  Issues  and 
Recommended  Practices.  It  is  informative,  well  written  and  a  thorough  treatment  of  this  important  and 
complex  subject. 
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their  tips  or  leads  from  COP.  Seventy-five  percent  of  the  reporting  fusion  centers  stated 
that  COP  was  an  under-utilized  information  source.  How  do  we  trade  on  the  community 
capital  of  goodwill  created  by  COP  and  how  do  we  make  that  work  in  the  collection  of 
information  useful  to  counterterrorist  action? 

The  Sacramento  Urban  Area,  and  indeed  the  nation  as  a  whole,  has  made  little 
attempt  to  engage  the  Muslim  community  in  targeted  COP  programs.  There  are 
exceptions,  such  as  Southeastern  Michigan,  Boston  and  Southern  California,125  but  as  a 
whole  the  law  enforcement  community  has  relied  on  COP  in  general  to  engage  the 
Muslim  community.  In  defense  of  law  enforcement,  limited  outreach  to  the  Muslim 
community  is  a  consequence,  in  part  due  to  the  fact  that  the  Muslim  community,  in  much 
of  the  country,  does  not  reside  in  ethnic  enclaves  as  they  do  in  Europe.  Muslims  are 
connected  by  a  religion  and  often  by  an  ethnicity,  but  are  dispersed  throughout  our 
community,  and  as  such,  have  been  difficult  to  engage  with  the  COP  program. 

This  is  due  to  the  consistent  and  common  theme  throughout  almost  all  of  the 
literature  and  practice  regarding  COP:  the  interpretation  of  community  as  having  a 
definite  geographic  orientation  or  boundary.  COP  in  the  United  States  is  almost 
exclusively  geographic-centric  within  well-defined  and  tightly  controlled  boundaries 
determined  by  jurisdictional,  environmental,  and  economic  or  social  groupings. 

Given  the  geographic  dispersal  of  the  majority  of  the  Muslim  community,  an 
effective  COP  program  must  make  a  paradigm  shift  from  a  geographic-centric  orientation 
to  an  ideological-centric  orientation.  Daniel  Flynn,  in  a  white  paper  for  the  Police 
Executive  Research  Forum,  discusses  the  concept  of  community  and  non-traditional 
communities  in  depth.  His  paper  accurately  describes  the  need  to  be  flexible  in 
identifying  a  community  so  as  to  be  able  to  include  groups  that  share  a  common  character 
or  identity  with  a  common  concern  or  problem.  Flynn  describes  a  nontraditional 
community  as: 

125  Deborah  Ramirez,  Sasha  C.  O’Connell,  and  Rabia  Zafar,  “Developing  Partnerships  between  Law 
Enforcement  and  American  Muslim  Arab  and  Sikh  Communities  A  Promising  Practices  Guide,  The 
Partnering  for  Prevention  and  Community  Safety  Initiative,”  Northeastern  University,  2004, 
http://sps.neu.edu.  Last  accessed  September  20,  2007.  This  report  discusses,  in  some  depth,  community 
outreach  practices  to  the  Muslim,  Arab  and  Sikh  communities. 
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The  non-traditional  community  is  more  than  a  special  interest  group  or 
group  formed  around  one  issue.  The  non-traditional  community  is 
systemic  and  consists  of  a  collection  or  set  of  groups  that  share  the 
characteristics  of  the  community.  It  is  not  restricted  to  being  residential  or 
residential/business  and  it  need  not  be  located  in  areas  beset  with  deep- 
seated  chronic  high  crime  rates.126 

Therefore,  a  COP  program  with  the  aim  of  ameliorating  alienation  and 
disaffection  for  the  Muslim  community  from  the  larger  community  as  a  whole,  and 
developing  contacts  that  could  potentially  lead  to  useful  information,  will  require  a  new 
conceptualization  of  “community.”  This  is  a  rather  radical  departure  from  the  common 
and  current  practice  and  there  will  be  many  challenges.  However,  there  is  a  great  need  to 
reach  out  to  the  Muslim  community,  which  has  its  religion  and  culture  inextricably 
woven  together.  A  re-assessment  of  community  and  a  fresh  set  of  strategies  will  help  us 
gain  a  connection  with  the  Muslim  community.  It  is  critical  that  the  primary  motivation 
is  to  recognize  them  as  valued  members  of  our  community  and  ease  the  feelings  of 
alienation  and  the  sense  of  being  disconnected  from  the  larger  community. 

The  creation,  development  and  implementation  of  such  a  program  will  be  a 
significant  undertaking.  The  desire  to  immediately  try  to  turn  members  of  the  Muslim 
community  into  informants  may  be  tempting,  but  should  be  avoided.  Information 
exchanges  of  that  kind  requires  trust  and  mutually  beneficial  relationships  (either 
financial  or  common  cause),  particularly  when  the  consequences  of  providing 
information  could  be  costly  to  yourself  and  your  family. 

When  a  COP  program  is  rolled  out  to  the  community,  we  need  to  make  sure  that 
we  are  providing  an  environment  that  creates  relationships  with  the  Muslim  community 
that  are  seen  as  altruistic  and  mutually  beneficial.  Some  potential  areas  to  explore  would 
include:  1)  a  Muslim  citizens’  academy;  2)  political  action  groups  of  some  type  that 
would  have  a  community  voice  and  access  to  administrators  and  the  law  enforcement 
community,  as  well  as  local  government;  3)  the  development  of  youth  programs  and 
activities  that  do  not  isolate  Muslim  youth  but  engage  them  with  other  members  of  the 

126  Daniel  W.  Flynn,  Defining  the  Community  in  Community  Policing,  Police  Executive  Research 
Forum,  1998,  8. 
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community;  4)  using  the  media  to  recognize  positive  Muslim  events  or  citizen  activities; 
5)  establish  educational  forums  for  the  public  and  law  enforcement  about  the  Muslim 
community  in  an  attempt  to  try  to  establish  understanding  and  positive  community 
relations;  and,  6)  in  recognition  of  the  Muslim  culture’s  religious  requirement  to 
contribute  to  charity,  a  committee  could  be  established  to  identify  charities  that  have  no 
demonstrable  links  to  terrorism. 

Once  we  have  created  contacts  and  relationships  built  on  mutually  beneficial 
activities,  the  bonds  of  trust  necessary  to  engage  in  information  sharing  will  have  been 
established.  Potentially  useful  information  will  flow,  in  time,  with  confidence  and  trust. 
If  the  intelligence  collection  process  is  started  too  soon,  our  efforts  will  be  seen  as  thinly 
disguised  self-serving  opportunities  and  will  not  be  well  received. 
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V.  RECOMMENDATIONS  FOR  FUSION  CENTER  OPERATION 


Prevention  is  the  first  goal  in  the  National  Strategy  for  Homeland  Security.  It  can 
be  argued  that  fusion  centers  provide  an  excellent  opportunity  to  for  that  prevention.  For 
fusion  centers  to  be  effective,  it  will  be  necessary  for  elected  officials,  emergency 
responders,  administrators,  and  the  rank  and  file  emergency  responder  community  to 
know  the  value  that  fusion  centers  provide.  There  are  many  secrets  in  fusion  centers;  the 
value  of  the  fusion  center  must  not  be  kept  secret.  The  following  are  recommendations 
based  on  the  findings  of  this  thesis,  grouped  by  fusion  center  functions: 

A.  MANAGEMENT 

1.  Mission 

The  management  of  the  fusion  center  should  not  be  left  to  develop  in  a  haphazard 
manner  with  little  forethought  as  to  an  ultimate  strategic  plan  to  achieve  the  goal  of  how 
best  to  detect  or  deter  a  terrorist  attack.  This  was  perhaps  acceptable  in  the  immediate 
aftermath  of  9/1 1.  However,  with  time  for  reflection  and  thought,  it  is  important  to  assess 
the  role,  function,  and  responsibilities  of  fusion  centers  and  to  determine  how  they  are 
managed  and  what  they  should  produce.  Fusion  centers  will  require  guidance  to 
accomplish  that  objective. 

One  of  the  first  steps  should  be  the  development  of  a  governance  board.  The 
board  should  have  a  cross  representation  of  federal,  state  and  local  members,  as  well  as 
representation  from  different  emergency  responder  disciplines.  Suggested  representation 
should  include  FBI  and  U.S.  Attorneys’  Offices,  lead  law  enforcement  executives  in  the 
region,  and  at  least  one  non-law  enforcement  executive  from  the  emergency  responder 
community.  This  governance  board  would  ensure  a  regional  approach,  collaboration  and 
network  with  all  partners  (rather  than  a  parochial  orientation  directed  at  one  particular 
agency’s  priorities),  create  a  network  of  interdependent  jurisdictions  and  disciplines  with 
a  common  and  acceptable  tasking  requirement  for  the  fusion  center.  The  centers  are 
essentially  law  enforcement  organizations,  but  they  serve  a  greater  mission  that 
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incorporates  the  sphere  of  all  the  emergency  responders  and  their  input  will 
prove  valuable,  enhancing  the  intelligence  product. 

The  board  should  adopt  a  written  memorandum  of  understanding  or  similar 
agreement  with  a  written  mission  statement.  This  thesis  reaffirms  the  recommendations 
found  in  the  FCG  guideline  three  regarding  the  above  recommendations  for  a  governance 
board;  however,  it  is  also  recommended  that  further  steps  be  taken.  One  of  the  most 
important  actions  the  board  should  take  —  in  addition  to  determining  who  the  customers 
of  the  fusion  center  are  —  is  to  determine  the  degree  of  support  each  customer  should  be 
allocated.  The  common  customers  of  a  fusion  center  are  tactical  investigative  case 
support  (generally  for  the  FBI  Joint  Terrorism  Task  Force);  criminal  case  support  for 
major  criminal  enterprises;  general  situational  awareness  for  emergency  responders;  and, 
strategic  situational  awareness  reports  on  regional  threat  assessments  for  policy  makers. 
The  range  of  support  for  these  different  customers’  groups  is  huge,  with  some  working 
almost  exclusively  strategic  support  and  some  working  almost  exclusively  in  support  of 
the  JTTF.  There  is  not  a  right  or  wrong  to  any  of  these  approaches,  but  they  should  be 
based  on  an  identified  need,  supported  by  a  regional  threat  picture,  and  authorized  by  the 
direction  of  an  involved  governance  board,  reinforced  by  the  mission  statement.  The 
scope  of  work  should  not  be  directed  simply  by  “it’s  what  we’ve  always  done.” 

In  order  to  accomplish  these  goals,  the  board  must  have  an  accurate  situational 
awareness  of  the  threat  picture  in  their  area  of  operation,  as  well  as  any  particular 
vulnerability  that  their  region  may  possess.  This  will  require  high-level  briefings  by 
qualified  personnel. 

The  board  should  agree  to  meet  on  a  regular  basis  to  keep  informed  and  maintain 
connection  with  the  fusion  center  and  other  board  members.  The  board  should  also 
recognize  that  fusion  centers  are  a  relatively  new  phenomenon  for  domestic  law 
enforcement,  keeping  in  mind  the  need  to  be  flexible  and  responsive  to  changes.  Finally, 
the  board  needs  to  ensure  that  the  fusion  center  is  familiar  with  the  mission  and  is,  in  fact, 
adhering  to  that  mission. 
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Agency  heads  of  law  enforcement  and  fire  departments  should  obtain  secret 
clearances,  available  through  the  Department  of  Homeland  Security,  so  that  they  may  be 
briefed  properly  and  gain  confidence  that  everything  that  can  or  should  be  shared  is  being 
shared. 


2.  Philosophy 

The  threat  of  a  terrorist  attack  has  dramatically  shifted  the  focus  of  local  law 
enforcement.  The  investigation  of  terrorism,  and  the  collection  and  analysis  of 
intelligence  to  aid  in  prevention,  is  a  new  role  for  domestic  law  enforcement;  this 
newness  is  a  major  sticking  point  as  to  how  best  to  accomplish  this  obvious  but  elusive 
goal. 


3.  Prevention 

It  can  be  argued  that  prevention  may  well  be  the  best  way  to  protect  one’s 
community.  In  the  immediate  aftermath  of  9/11,  the  vast  majority  of  resources  were 
dedicated  to  strengthening  our  response  capabilities.  Prevention  as  an  active  goal  is  a 
relatively  new  philosophical  position.  The  benefits  of  prevention  can  be  demonstrated  by 
illustrating  the  values  of  strategic  situational  awareness  for  policymakers,  tactical  case 
support  for  counterterrorist  efforts,  and  criminal  case  support  for  major  crimes  that 
present  a  real  and  visible  threat  to  local  communities.  It  is  a  recommendation  of  this 
thesis  that  educating  administrators  on  the  value  and  benefits  of  prevention  become  a 
specific  goal;  this  is  a  recommendation  that  is  missing  from  the  FCG. 

As  part  of  prevention,  a  risk  management  policy  needs  to  be  adopted.  While  this 
thesis  cannot  recommend  what  is  the  best  risk  management  policy,  it  is  recommended 
that  the  issue  be  addressed,  debated  and  resolved.  The  issue  is:  what  is  an  acceptable 
level  of  risk  within  one’s  community  and  how  does  one  most  effectively  and  efficiently 
buy  down  that  risk  with  the  dollars  allocated  to  prevention?  The  answer  to  that  question 
is  your  risk  management  policy.  What  must  be  considered  is  not  only  your  community’s 
tolerance  for  risk,  but  what  risks  are  considered.  Will  your  risk  management  policy  focus 
exclusively  on  the  prevention  and  response  to  the  remote  threat  of  a  WMD  or  will  you 
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address  the  more  likely  conventional  terrorist  attack  of  an  improvised  explosive  device,  a 
vehicle  borne  improvised  explosive  device,  or  a  firearm. 

Whatever  prevention  model  and  risk  management  positions  are  taken,  they  need 
to  be  predicated  on  the  threat  picture  that  the  fusion  center  is  operating  under. 
Recognizing  the  local  threat  picture,  keeping  aware  of  the  emergent  tends  as  well  as 
investigating  and  interdicting  these  threats  whenever  possible,  is  a  job  where  the  fusion 
center  can  make  a  significant  contribution.  These  threats  will  necessarily  include  jihadist 
ideologies,  both  the  transnational  and,  more  likely,  the  locally  generated  homegrown 
jihadist,  but  will  also  include  other  domestic  concerns  such  as  radicalized  prisoners, 
environmental  terrorists,  right-wing  terrorists  and  other  single-issue  groups. 

4.  Tactical  vs.  Strategic 

It  is  the  recommendation  of  this  thesis  that  the  next  iteration  of  the  Fusion  Center 
Guidelines  addresses  and  agrees  upon  the  definitions  and  roles  of  strategic  analyst, 
strategic  analysis,  tactical  analyst,  tactical  analysis,  criminal  analyst  and  criminal 
analysis,  as  there  is  no  current  distinction  between  what  is  tactical  and  what  strategic. 
The  FCG  have  a  heavy  bias  toward  the  tactical,  which  is  not  surprising,  as  the  majority  of 
the  work  in  state  and  local  fusion  centers  is  currently  being  done  at  the  tactical  level. 
However,  there  is  a  need  for  strategic  analysis  and  it  should  be  clearly  identified  as  to 
what  it  is  and  who  might  be  the  potential  customer. 

The  staff  of  the  fusion  center  should  reflect  the  mission  and  customer  support 
allocations  established  by  the  governance  board  and  the  director  of  the  fusion  center.  As 
it  stands,  the  majority  of  fusion  centers  provide  more  tactical  mission  support  than 
strategic  assessments  (tactical  as  in  case  support  through  research,  database  searches,  and 
link  analysis  activities,  not  field  operations).  Most  centers  would  likely  get  by  with  one 
or  two  strategic  analysts,  and  as  they  are  much  more  difficult  and  expensive  to  engage 
and  retain,  a  fusion  center  should  not  try  to  over-staff  with  expensive  personnel  that  will 
not  be  utilized  properly.  The  majority  of  the  analytic  support  staff  ought  to  be  geared 
toward  the  greater  workload,  tactical  case  support.  If  a  center  starts  to  make  more  use  of 
strategic  analysis,  then  the  staffing  should  be  adjusted  accordingly. 
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The  information  revealed  in  this  thesis  indicates  that  the  overwhelming  majority 
of  fusion  centers  should  have  some  type  of  all-crime  perspective.  It  should  go  without 
saying  that  any  active  counterterrorism  investigative  support  should  always  have  a 
primary  role  in  the  fusion  center.  Most  fusion  centers  already  incorporate  some  type  of 
all-crime  posture  in  their  fusion  centers. 

Elected  officials  and  administrators  should  also  be  encouraged  to  use  the  tasking 
capability  to  have  strategic  products  prepared  that  are  of  concern  to  local  officials.  This 
level  of  customer  service  and  interaction  will  not  only  help  educate  administrators  as  to 
the  usefulness  of  the  fusion  center,  but  also  establish  contacts  and  the  beginnings  of  a 
network.  This  increased  interaction  could  lead  to  increased  support  and  funding. 

5.  Prioritization 

There  should  be  some  system  or  process,  either  from  the  governance  board  or  the 
director,  that  identifies  the  prioritization  of  work  to  be  done.  This  can  be  accomplished  in 
the  crafting  of  the  standing  requirements  for  the  fusion  center.  There  should  also  be 
prioritization  for  case  assignment  for  incoming  tips.  Not  all  tips  are  alike  and  they  should 
not  be  treated  as  such.  Some  form  of  metrics  should  be  established  to  detennine  the 
extent  of  investigation  accorded  each  tip  or  lead;  otherwise,  we  may  well  find  ourselves 
doing  exhaustive  investigations  on  tips  that  are  months  old  while  neglecting  more 
promising  leads  on  current  tips.  This  concept  is  generally  refereed  to  in  FCG  guideline 
two,  but  should  be  called  out  more  specifically  in  future  iterations. 

6.  Leadership 

To  carry  out  the  mission  of  the  fusion  center,  the  governance  board  should 
designate  a  director  who  will  be  responsible  and  accountable  for  the  operation  of  the 
fusion  center.  The  FCG  guideline  number  three  states  that  the  governance  board  should 
define  a  management  structure  to  include  what  entity  will  oversee  the  center’s  operations 
and  daily  activities.  There  is  no  recommendation  on  how  that  should  be  accomplished; 
however,  consideration  should  be  given  to  the  need  for  a  director  to  have  a  wide  range  of 
experience  in  intelligence,  law  enforcement  and  the  fusion  process.  More  importantly, 
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the  director  should  have  the  ability  to  establish  and  maintain  networks,  provide  leadership 
in  the  fusion  center,  guide  intelligence  production,  and  maintain  the  standards  that  are 
critical  to  continued  and  effective  intelligence  operations.  Without  the  appropriate 
guidance  and  leadership,  the  fusion  centers  risk  misdirection  and  misapplication  of  their 
mission  and  focus,  and  could  end  up  producing  intelligence  products  that  are  irrelevant  or 
inapplicable  to  their  environment.  The  management  style  and  networking  abilities  of  a 
director  will  be  at  least  as  important  as  technical  knowledge,  which  needs  to  be 
recognized. 

In  the  emergent  and  evolving  world  of  counterterrorism,  autocratic  and  hierarchal 
management  styles  will  be  not  only  ineffective  but  counter-productive.  To  operate 
effectively,  the  centers  will  need  to  be  able  to  operate  in  a  network,  sharing  information 
and  situational  information  with  various  levels  of  government,  jurisdictions,  and 
disciplines,  which  will  not  be  answerable  to  each  other,  requiring  a  cooperative 
networked  approach  to  management.  It  will  take  a  skillful  communicator  with  a 
recognized  degree  of  credibility  and  competence  to  garner  the  trust  necessary  to  interact 
with  these  divergent  groups. 

There  will  be  some  difficulties,  especially  in  locales  where  there  are  competing 
law  enforcement  jurisdictions  vying  for  control,  in  deciding  who  the  director  will  be  and 
from  what  agency.  It  will  be  up  to  the  board  to  find  a  person  acceptable  to  all  and  up  to 
the  director  to  show  impartiality  in  the  administration  of  his  or  her  office. 

B.  ANALYSTS 

Fusion  center  managers  need  to  make  the  distinction  between  strategic  analysts 
and  tactical  analysts.  The  strategic  analysts  are  generally  persons  with  graduate  degrees 
and  years  of  experience,  able  to  make  predictive  assessments  from  a  broad  range  of 
domain  expertise.  Tactical  analysts  conduct  post-event  research  and  assist  with  case- 
support  functions.  Both  are  valuable  and  necessary  skills  sets  but  serve  very  different 
missions.  The  center  needs  to  staff  appropriately  so  that  each  category  of  analyst  is 
performing  the  function  it  is  trained  and  qualified  to  conduct. 
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Strategic  analysts  will  almost  certainly  be  civilian  employees.  Tactical  analysts 
can  be  civilian  or  they  can  be  law  enforcement  officers,  and  occasionally  from  other  ER 
disciplines.  However,  it  takes  training  and  the  correct  aptitude  to  be  a  tactical  analyst;  it 
is  not  a  plug-and-play  operation  at  which  all  law  enforcement  personnel  will  be  adept. 
Additionally,  sworn  officer  analysts  will  rotate  for  career  development  or  promotions.  A 
high  analyst  turnover  will  almost  guarantee  a  constant  state  of  training  and  diminished 
capacity  as  staff  will  not  only  have  to  be  trained  in  job  functions,  but  wait  for  top  secret 
clearances  before  they  can  work  on  any  significant  projects.  The  turnover  will  also  affect 
historical  continuity.  For  these  reasons,  a  fusion  center  should  have  a  high  percentage  of 
its  analyst  staff  as  career  civilian  employees.  Requiring  and  enforcing  a  minimum  term, 
as  recommended  by  the  NCISP,  is  another  good  idea  to  maintain  a  qualified  analytical 
pool. 

It  is  noteworthy  to  observe,  however,  that  the  training  that  most  analysts  have 
received  has  been  from  professional  organizations  dedicated  to  the  profession  of  law 
enforcement  criminal  intelligence.  It  is  also  noteworthy  to  observe  that  the  Fusion  Center 
Guidelines  are  based  on  the  criminal  intelligence  process.  It  is  therefore  not  surprising 
when  the  CRS  report  notes  that  most  fusion  centers  are  not  operating  as  true  intelligence 
fusion  centers127  but  as  criminal  analyst  centers.  It  may  well  be  the  case  that  this  is  so 
because  the  greater  need  is  for  tactical  analysis  versus  strategic  analysis  in  the  state  and 
local  fusion  centers. 

C.  DISSEMINATION 

In  order  to  facilitate  the  dissemination  of  information  on  as  wide  a  distribution 
level  as  possible,  the  fusion  center  needs  to  write  their  proprietary  product  at  a  “for 
official  use  only”  (FOUO)  tear  line.  This  will  ensure  the  widest  possible  distribution  to 
the  greatest  number  of  emergency  responder  disciplines  as  well  as  individual  responders. 
Wherever  possible,  the  fusion  center  should  avoid  writing  product  that  is  classified  as 
secret  or  higher.  The  classification  "law  enforcement  sensitive"  (LES)  should  be  used 
very  judiciously,  and  should  have  written  protocols  to  use  as  guidelines  to  prevent  routine 


127  Masse  et  al.,  CRS  report  for  Congress,  Summary. 
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use  of  LES.  The  classification  distinction  between  “for  official  use  only”  and  “law 
enforcement  sensitive”  is,  in  many  respects,  one  of  semantics.  However,  what  it  does  is 
restrict  the  access  of  infonnation  to  fire  personnel  and  all  the  other  emergency  responder 
disciplines.  This  classification  should  be  avoided  unless  there  is  information  that  would 
compromise  a  criminal  investigation,  in  which  case  distribution  would  be  severely 
limited  at  whatever  classification.  The  law  enforcement  sensitive  classification  restricts 
potential  distribution  and  the  resultant  potential  return  of  information  and  creates  a 
contentious  relationship  with  our  partners.  The  center  should  also  encourage  originators 
of  products  received  to  avoid  LES  where  possible;  this  is  an  issue  not  addressed  by  the 
FCG. 

To  continue  and  expand  the  flow  of  information,  the  fusion  center  needs  to 
acknowledge  the  individual  emergency  responder  when  he  or  she  provides  a  tip  or  lead. 
It  is  imperative  to  acknowledge  this  information  whether  or  not  it  is  ultimately  proven  to 
be  useful.  In  fact,  the  center  should  not  wait  until  it  determines  the  value  of  the  tip  before 
the  contribution  is  acknowledged.  This  acknowledgment  should  be  automatic  upon 
information  being  provided  and  the  tipster  should  receive  a  reply  from  the  fusion  center 
with  some  generic  information  as  to  the  outcome  of  the  tip.  It  can  be  as  innocuous  as: 
this  infonnation  supports  an  ongoing  investigation,  this  information  is  filed  at  this  time, 
or  this  information  is  being  reviewed. 

The  center  does  not  need  to  reveal  sources  or  methods  to  acknowledge  those  that 
are  assisting  by  providing  information.  An  effort  on  the  part  of  the  fusion  center  to 
involve  and  acknowledge  the  emergency  responder  community  will  greatly  enhance  the 
participation  of  that  group  in  the  collection  of  raw  data  to  be  analyzed. 

The  most  common  and  effective  means  of  distributing  information  bulletins  to  the 
emergency  responder  community  seems  to  be  e-mail.  All  jurisdictions  should  make 
every  effort  to  insure  that  their  personnel  have  access  to  e-mail. 

The  FCGs  identify  the  need  for  dissemination  in  both  the  intelligence  process  and 
the  fusion  process  but  the  issue  of  consumption  is  not  addressed.  Production  of 
intelligence  product  needs  to  take  into  consideration  who  the  end  user  will  be  for  what 
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product,  and  what  will  be  the  best  form  to  convey  that  information  to  maximize 
assimilation.  Another  issue  not  addressed  by  the  FCGs  is  the  need  for  the  end  user  of 
each  category  of  product  to  provide  feedback  to  the  analysts  and  the  fusion  center 
management. 

D.  SUMMARY  OF  FUSION  CENTER  RECOMMENDATIONS 

•  Governance  board  should  determine  who  the  customers  are 

•  Governance  board  should  direct,  with  fusion  center  manager  input,  the 
level  of  support  for  each  customer,  i.e.  tactical  case  support  vs.  strategic 
situational  awareness 

•  Identify  the  workload  for  strategic  vs.  tactical  analysts 

•  Educate  local  ER  administrators  on  the  value  of  prevention 

•  Provide  situational  awareness  to  ER  administrators  so  that  an  objective 
risk  management  policy  can  be  adopted 

•  The  next  iteration  of  the  Fusion  Center  Guidelines  should  define  and 
develop  specific  roles  for  strategic  analyst,  tactical  analyst  and  crime 
analyst 

•  In  the  interim  fusion  centers  should  define  the  duties  and  role  of  strategic, 
tactical  and  crime  analysts  within  their  own  organizations 

•  Provide  analyst  training  relevant  to  their  role  and  future  development 

•  Maintain  a  high  percentage  of  civilian  analysts 

•  Provide  sufficient  situational  awareness  to  the  ER  community  so  that  they 
will  recognize  and  report  terrorist  pre  incident  indicators  when  they  are 
observed 

•  Provide  and  advertise  tip  and  lead  reporting  mechanisms  that  are  available 
and  user  friendly 
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•  Provide  an  all  crimes  perspective,  while  recognizing  the  counter  terrorism 
mission  is  primary 

•  Encourage  ER  administrators  to  use  their  tasking  capability  to  have 
strategic  products  prepared  that  are  of  concern  to  local  officials 

•  An  objective  system  of  prioritization  should  be  established  to  determine 
the  extent  of  investigation  accorded  each  tip  or  lead 

•  Each  fusion  center  should  have  a  director;  the  management  style  and 
networking  abilities  of  a  director  will  be  at  least  as  important  as  technical 
knowledge 

•  Write  and  disseminate  intelligence  product,  to  the  extent  possible,  at  “for 
official  use  only”  (FOUO) 

•  The  classification  "law  enforcement  sensitive"  (LES)  should  be  used  very 
judiciously,  and  should  have  written  protocols 

•  The  Fusion  Center  Guidelines  should  include  the  issue  of  intelligence 
consumption  when  discussing  dissemination 

•  The  Fusion  Center  Guidelines  should  include  end  user  feedback  for  all 
intelligence  products  in  the  next  iteration 
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VI.  RECOMMENDATION  FOR  DATA  COLLECTION 


As  often  repeated  throughout  this  thesis,  if  fusion  centers  are  to  become  valuable 
to  local  elected  officials,  emergency  responder  administrators,  and  emergency  responder 
line -personnel,  they  must  produce  timely,  relevant  and  locally  actionable  intelligence 
product.  To  produce  locally  actionable  intelligence,  the  fusion  center  will  have  to  not 
only  analyze  data  from  a  variety  of  classified  databases  and  a  huge  glut  of  open  source 
data,  but  also  integrate  information  collected  locally  from  the  regional  emergency 
responders  to  synthesize  a  final  product. 

A.  TERRORISM  LIAISON  OFFICERS 

One  of  the  best  ways  to  gather  this  intelligence  is  with  the  creation  and 
development  of  a  robust  terrorism  liaison  officer  (TLO)  program.  These  programs  most 
generally  start  with  law  enforcement  and  move  into  the  other  emergency  responder 
disciplines  addressing  the  unique  issues  of  each  discipline  in  turn.  Prior  to  initiating  a 
TLO  program,  those  responsible  for  implementing  it  should  contact  the  ER 
administrators  in  the  region  explaining  the  program  benefits  and  the  amount  of  resources 
those  administrators  can  be  expected  to  contribute;  this  is  normally  a  nominal  amount  of 
resources. 

Once  administrators  have  agreed  to  commit  to  the  program,  they  should 
recommend  which  officers  to  nominate  as  TLOs,  particularly  the  TLO  coordinator, 
should  a  coordinator  be  designated  for  that  agency.  The  TLOs  must  have  access  to  the 
management  of  their  individual  organizations  as  well  as  credibility  with  and  access  to  the 
rank-and-file  of  their  respective  organizations.  TLOs  should  receive  training  in  basic 
situational  awareness  of  terrorist  methods  of  operation  and  pre-incident  indicators.  TLOs 
should  also  receive  training  on  how  to  facilitate  the  TLO  program  back  in  their 
jurisdiction. 

The  roles  and  responsibilities  for  TLOs  must  be  established  and  clearly  articulated 
so  that  people  understand  what  their  jobs  are,  and  equally  important,  what  they  are  not. 
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Most  TLO  programs  have  established  the  role  of  the  TLO  to  be  a  point  of  reference  and  a 
contact  for  his  or  her  fellow  officers  or  firefighters.  Some,  as  in  the  case  of  Arizona,  are 
responders,  which  is  a  much  more  expensive  proposition.  Whichever  route  is  taken,  the 
role  of  the  TLO  must  be  very  clear  in  the  mind  of  the  TLOs  themselves,  their 
administrators  and  the  rank-and-file. 

Once  the  law  enforcement  TLO  program  has  been  stood  up,  the  fusion  center 
should  turn  their  attention  to  developing  TLO  programs  within  the  other  emergency 
responder  disciplines.  As  with  the  law  enforcement  TLOs,  it  will  be  important  to  develop 
a  need  to  report  observations  as  well  as  establish  a  value  to  reporting  such  information. 
This  will  be  even  more  so  in  the  other  emergency  responder  disciplines  as  they  are  not 
naturally  geared  toward  investigation,  observation  and  reporting  of  behavior.  This  will 
be  particularly  true  for  the  medical  professions  who  are  confronted  with  issues  of 
patients’  privacy.  The  infonnation  that  these  responders  can  provide  could  be  very 
valuable,  and  certainly  will  be  worth  the  effort  to  educate  all  involved  in  the  process  of 
legally  and  ethically  providing  this  information  to  the  fusion  centers.  However,  great 
care  must  be  taken  to  ensure  that  all  laws  are  followed  and  that  the  ERs  are  educated  to  a 
level  that  makes  them  comfortable  with  reporting  information  that  is  pennissible. 

B.  TERRORISM  EARLY  WARNING  GROUP  (TEWG) 

The  establishment  of  terrorism  early  warning  groups  is  an  excellent  way  for  the 
fusion  centers  to  gain  infonnation  on  sector-specific  infonnation  or  infonnation  derived 
from  particular  areas  of  concern.  Examples  include  the  agriculture  industry,  chemical 
industry,  transportation,  and  school  administrators.  The  TLOs,  in  conjunction  with  the 
fusion  center  and  local  ER  administrators,  should  identify  which  tenorism  early-warning 
groups  would  be  beneficial  to  their  individual  regions,  and  together,  should  identify  a  list 
of  who  should  or  could  be  involved  in  this  activity. 

These  groups  will  require  some  form  of  quid  pro  quo;  generally,  useful 
information  will  be  sufficient  currency  for  their  involvement.  There  are  many  ways  to 
start  these  programs;  most  often,  the  easiest  is  to  start  with  existing  groups  or 
organizations.  Often  there  are  industry  associations  that  meet  on  a  regular  basis.  In 
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addition,  emergency  response  planning  meetings  are  often  used  as  a  catalyst  to  initiate  a 
TEWG.  One  useful  program  that  has  been  successful  in  some  jurisdictions  is  the  FBI’s 
InfraGard  program.  Once  these  programs  or  TEWGs  are  established,  however,  they 
cannot  be  abandoned.  It  will  take  a  concerted  effort  and  regular  interaction  to  maintain 
the  relationships  that  will  promote  the  useful  exchange  of  information.  Administrators 
also  need  to  be  mindful  of  the  possibility  of  TLOs  becoming  over-extended  and  unable  to 
make  all  the  requested  commitments.  Most  TLOs  take  on  the  job  as  an  “other  duty  as 
assigned,”  and  not  a  full-time  job. 

In  the  event  an  agency  chooses  a  purely  terrorist  orientation  for  the  fusion  center, 
as  opposed  to  an  all-crimes  approach,  it  would  be  valuable  for  those  agencies  to  establish 
a  TEWG  with  the  criminal  investigative  units  of  the  region’s  law  enforcement  agencies. 

C.  COMMUNITY-ORIENTED  POLICING 

One  final  method  of  data  collection  for  the  emergency  responder  community  is 
community  oriented  policing  (COP).  This  approach  would  be  by  far  the  most  labor- 
intensive  of  those  discussed.  The  benefit  potential  is  significant  and  the  concept  deserves 
some  attention.  A  properly  developed  COP  program  can  engage  local  Muslim 
communities  to  enhance  their  sense  of  belonging  and  comfort  and,  at  the  same  time, 
minimize  any  feelings  of  alienation,  mistrust  or  disaffection.  A  second  benefit  —  one 
that  will  come  in  due  course  if  the  program  is  established  with  honest  intentions  and  not  a 
thinly  veiled  attempt  to  create  immediate  informants  —  is  the  establishment  of 
relationships  and  trust.  Once  these  are  ingrained,  the  increased  confidence  level  in  the 
“system”  may  lead  to  increased  reporting  of  suspicious  behaviors  that  members  of  the 
Muslim  community  may  become  aware  of  or  actually  witness. 

As  many  in  the  Muslim  community  do  not  live  in  tight  geographic  confines,  as  is 
often  the  case  in  Europe,  a  successful  COP  program  would  have  to  interpret  community 
as  larger  or  different  from  the  common  geographic  consideration.  Community  will  have 
to  be  perceived  in  more  of  an  ideological  context  rather  than  a  neighborhood  concern. 
Acting  now,  to  build  positive  relationships  by  involving  and  engaging  the  Muslim 
community,  will  not  only  provide  a  rich  and  useful  source  of  future  infonnation,  it  will, 
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more  importantly,  have  the  capability  of  preventing  future  attacks  by  removing  potential 
terrorists  from  the  ranks  of  recruits  for  radicalized  jihadist  ideology.  This  relationship 
must  be  based  on  fair,  reasonable  and  reciprocal  relationships  that  are  respectful  of  each 
other’s  rights,  needs  and  objectives. 

D.  SUMMARY  OF  DATA  COLLECTION  RECOMMENDATIONS 

•  Each  fusion  center  should  develop  a  TLO  program  in  their  area  of 
responsibility 

•  Local  administrators  should  be  engaged  and  educated  for  support 

•  Local  administrators  need  to  select  their  TLOs 

•  The  fusion  centers  should  provide/facilitate  training  for  the  TLOs 

•  TLOs  need  to  be  trained  on  the  organizational  and  administrative 
responsibilities  of  their  role 

•  The  fusion  center  should  provide  regular  intelligence  products  to  the  TLOs 

•  The  fusion  centers  ought  to  provide  a  support  network  to  sustain  the  TLOs 

•  TLOs  are  encouraged  to  develop  TEWGs  as  they  are  able  and  as  need 
exists 

•  Local  agencies  should  assist  in  maintaining  a  cadre  of  trained  TLOs  to 
respond  to  staff  turnover  issues 

•  A  COP  program  in  the  Muslim  community  should  consider  community  as 
a  non  geographic  concept  and  define  it  more  ideologically 
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VII.  CONCLUSION 


No  one  can  know  what  our  threat  potential  is  in  the  current  environment.  As  a 
country  and  as  local  public  servants,  we  need  to  be  prepared  without  over-reacting, 
protect  both  our  citizens  and  our  rights,  and  be  proactive  in  providing  intelligence  to  deter 
and  mitigate,  within  a  reasonable  budget  with  reasonable  risks.  Fusion  centers  have  the 
capability  of  assisting  in  these  efforts.  They  also  have  the  capability  to  fail.  It  is  the 
responsibility  of  those  in  fusion  center  governance  and  management  positions  to  ensure 
that  fusion  centers  succeed.  Success  can  and  should  be  defined  locally;  the  criterion  for 
success  needs  to  be  clearly  articulated. 

This  thesis  started  by  asking  the  questions:  What  is  the  mission  of  the  state  and 
local  fusion  centers?  Do  they  have  a  national  value?  Do  they  have  a  local  value?  I 
believe  the  evidence  presented  herein  has  demonstrated  that  state  and  local  fusion  centers 
do  indeed  have  a  real  mission  in  the  protection  of  our  homeland,  and  in  the  process  can 
contribute  both  a  national  and  a  local  value.  To  do  this,  however,  fusion  centers  will 
have  to  respond  the  second  research  question:  What  can  be  done  to  improve  the 
effectiveness  of  state  and  local  fusion  centers? 

Fusion  centers  can  accomplish  this  by  identifying  their  mission  and  their 
customers,  at  what  level  of  analytic  product  they  will  produce,  and  to  whom.  Not  all 
fusion  centers  will  need  the  same  amount  of  strategic  analysis  or  tactical  analysis,  but,  in 
order  to  determine  what  to  produce,  they  will  have  to  understand  their  customers’  needs 
and  ensure  they  are  educated  so  they  understand  the  difference  between  the  two  products. 
Fusion  centers  will  also  need  to  determine  how  they  will  integrate  the  emergency 
responder  community.  A  TLO  program  is  one  method  that  shows  promise  and  is  easily 
adaptable. 

It  is  the  responsibility  of  those  in  fusion  center  governance  positions  and 
management  positions  to  ensure  that  fusion  centers  succeed.  If  the  fusion  centers  can 
produce  a  timely,  locally  actionable  and  relevant  product  to  its  customers  —  in  the  form 
of  strategic  analysis  to  policy  makers;  tactical  analysis  to  counter  terrorism;  tactical 
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analysis  to  major  criminal  investigations;  and,  situational  awareness  and  reporting 
mechanisms  to  the  emergency  responder  community  —  they  will  have  established  their 
value. 

By  implementing  the  key  recommendations  of  this  thesis,  fusion  centers  will 
progress  into  becoming  significant  assets  in  our  counterterrorism  fight.  If  fusion  centers 
fail  to  prove  their  relevance  and  local  worth,  they  face  the  danger  of  losing  support,  not 
only  from  federal  funding  sources,  but  also  from  local  agencies,  which  sponsor  a  great 
deal  of  the  state  and  local  fusion  center  resources. 

This  thesis  has  also  left  many  unanswered  questions  that  future  efforts  could 
research.  Some  issues  for  future  researchers  to  consider  are: 

•  Do  these  results  reflect  trends  in  other  fusion  centers  or  are  they  specific  to 
California? 

•  The  development  of  a  uniform  definition  and  role  for  strategic,  tactical  and 
criminal  analysts. 

•  The  development  of  a  process  for  consumer  intelligence  requirements  and 
product  delivery. 

•  The  role  and  impact  of  leadership  on  fusion  centers. 

•  The  impact  of  information  sharing  at  multi-government  levels. 

•  Further  research  on  TLO  programs  and  their  effectiveness. 

•  The  use  of  community-oriented  policing  as  a  counterterrorism  tool  (or  its 
lack  of  effective  use). 

•  The  issue  of  situational  awareness  of  terrorist  threat  in  the  emergency 
responder  community. 

•  What  parameters  or  influences  guide  the  level  of  strategic  analysis  that  is 
needed  at  the  state  and  local  level? 
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APPENDIX 


Emergency  responder  information  collection 

1.  Fusion  Center  Survey 


The  purpose  of  this  survey  Is  to  elicit  Information  from  fusion  centers  about  their  method  of  operation,  organization 
and  goals.  The  survey  Is  also  trying  to  determine  the  type  and  amount  of  data  sources  employed  and  how  the  end 
product  is  used  and  by  whom.  It  also  attempts  to  identify  common  Issues  and  needs  from  the  perspective  of  those 
operating/managing  fusion  centers.  The  survey  should  take  about  15  minutes  to  fill  out  and  should  be  filled  out  by  a 
director  or  manager  of  the  fusion  center.  Thank  you  for  your  time. 

The  Individual  responses  will  remain  confidential  unless  you  Indicate  otherwise  at  the  end  of  the  survey. 


Glossary 

Line-  first  line  personnel,  i.e.  fire  fighter,  police  officer 
Unit-  organization  that  comprises  the  referenced  group 
ER-  Emergency  Responder 
TLO-  Terrorism  Liaison  Officer 

Maturity-  level  of  operational  readiness  of  a  fusion  center,  (i.e.  a  mature  fusion  center  has  a  trained  staff  with 
clearances  and  access  to  classified  data  bases). 

Task-Ability  to  assign  work,  analysis  or  a  data  request 
Training-standardized  training  from  a  recognized  analyst  training  institution 

1.  Is  your  unit: 

A  fusion  center 

An  intelligence  unit 

Regional  collaboration 

Single  entity,  i.e.  police  intelligence  unit 

If  you  are  other  than  a  single  entity  unit  who  are  your  partners? 


2.  Is  your  unit: 


Federally  funded 
State  funded 
Locally  funded 
Combination 
Other  (please  specify) 


3.  How  much  of  your  fusion  center  is  grant  funded? 


less  than  10% 

10-25% 

26-50% 

51-75% 

76-100% 

State 

o 

o 

o 

o 

o 

Federal 

o 

o 

o 

o 

o 

Other 

o 

o 

o 

o 

o 

Page  1 
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Emergency  responder  information  collection 


4.  How  would  you  rate  the  current  maturity  of  your  unit? 

Operational  status 


We  are  at  the 
concept/proposal  stage 
Our  current  staffing  level 
is 

Percentage  of  our  staff 
with  Top  Secret  clearance 

Percentage  of  our  staff 
that  has  access  to 
classified  data  bases 

Percentage  of  staff 
trained  and  cleared  to 
operate  secure  data 
bases 

Percentage  of  staff 
trained  in  intelligence 
analysis 

Other  (please  specify) 


5.  What  is  the  status  of  your  training? 

What  analysis  training 
does  your  staff  receive? 

What  analysis  training 
would  you  like  to  see 
available  for  your  staff? 

6.  Is  your  unit's  primary  function  tactical  (case  support)  or  strategic  (policy/threat 
assessment)? 


d 

Zl 


7.  Who  is  the  primary  consumer  of  your  product? 


Never 

Seldom 

Sometimes 

Often 

Most  of  the 

time 

Almost  always 

Always 

Investigators 

o 

o 

o 

o 

o 

0 

o 

Policy  Makers 

o 

o 

o 

o 

o 

o 

o 

Law  Enforcement 

o 

o 

o 

o 

o 

o 

o 

Elected  Officials 

o 

o 

o 

o 

o 

o 

o 

Non  Law  enforcement 
emergency  responders 

o 

o 

o 

o 

o 

o 

o 

Other  O  O 

If  product  is  for  investigators,  what  is  the  crime  category? 

o 

o 

o 

0 

o 

Page  2 
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Emergency  responder  information  collection 


8.  What  amount  of  your  source  data  for  analysis  comes  from: 


Less  than  10% 

10-25% 

25-50% 

50-75% 

75-100% 

Federal  government,  i.e. 
FBI 

□ 

□ 

□ 

□ 

□ 

State  government 

□ 

□ 

□ 

□ 

□ 

Local  agencies 

□ 

□ 

□ 

□ 

□ 

Open  source 

□ 

□ 

□ 

□ 

□ 

Private  Sector 

□ 

□ 

□ 

□ 

□ 

Other 

□ 

□ 

□ 

□ 

□ 

9.  Of  your  local  agencies  data  sources  what  amount,  if  any. 

comes  from: 

Less  than  10% 

10-25% 

25-50% 

50-75% 

75-100% 

Law  Enforcement 

□ 

□ 

□ 

□ 

□ 

Terrorism  Liaison  Officer 

(TLO) 

□ 

□ 

□ 

□ 

□ 

Fire 

□ 

□ 

□ 

□ 

□ 

Public  Health 

□ 

□ 

□ 

□ 

□ 

Emergency  Medical 

Services 

□ 

□ 

□ 

□ 

□ 

Public  Works 

□ 

□ 

□ 

□ 

□ 

Other 

□ 

□ 

□ 

□ 

□ 

Other  (please  specify) 

10.  Of  all  the  data  sources  you  employ  for  intelligence  data  collection  and  analysis 

how  much  of  the  data  comes  from: 

Less  than  10% 

10-25% 

25-50% 

50-75% 

75-100% 

Open  sources  (i.e. 
media/internet) 

□ 

□ 

□ 

□ 

□ 

For  Official  Use  Only  (i.e., 
regional  law 
enforcement) 

□ 

□ 

□ 

□ 

□ 

Secret  (i.e.,  classified 
government  source) 

□ 

□ 

□ 

□ 

□ 

Top  Secret 

□ 

□ 

□ 

□ 

□ 

11.  What  percentage  of  the  work  produced  in  your  unit  is  disseminated  at  the: 

Less  than  10% 

10-25% 

25-50% 

50-75% 

75-100% 

Unclassified  level 

□ 

□ 

□ 

□ 

□ 

For  Official  Use  Only 

□ 

□ 

□ 

□ 

□ 

Law  Enforcement 

Sensitive 

□ 

□ 

□ 

□ 

□ 

Secret 

□ 

□ 

□ 

□ 

□ 

Top  Secret 

□ 

□ 

□ 

□ 

□ 
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Emergency  responder  information  collection 


12.  How  is  your  intelligence  product  disseminated  at  the  different  classification 
levels? 

Dissemination  method 

For  Official  Use  Only  |  [  ▼  | 

Law  Enforcement  I  |V| 

Sensitive 

Secret  [  |^| 

Top  Secret  |  |  ▼  | 

Unclassified  |  [  ▼  | 

Other  (please  specify) 


13.  What  method  does  your  unit  use  to  disseminate  information/intelligence  to  the 
line  level  emergency  responder  (ER)  community. 

Unit  has  an  internal  method  to  disseminate  to  line  level  ERs 
Unit  relies  on  liaisons  to  ER  community  to  disseminate  info 
Unit  disseminates  to  investigative  units  only 
Other  (please  specify) 


14.  Do  you  think  that,  as  a  source,  the  line  level  Emergency  Responder  community 
has: 


Never 

Seldom 

Sometimes 

Often 

Usually 

Almost 

always 

Always 

N/A 

Access  to  potentially 
valuable  information? 

o 

o 

o 

o 

o 

o 

o 

o 

Is  sufficiently  aware  of 
what  to  look  for? 

o 

o 

o 

o 

o 

o 

o 

o 

Has  appropriate  reporting 

mechanisms 

o 

o 

o 

o 

o 

o 

o 

o 

Is  aware  of  reporting 
mechanisms 

o 

o 

o 

o 

o 

o 

o 

o 

Mechanisms  are  avaliable 

o 

o 

o 

o 

o 

o 

o 

o 

Mechanisms  user  friendly 

o 

o 

o 

o 

o 

o 

o 

o 

Is  taking  full  advantage 
of  reporting  opportunities 

o 

o 

o 

o 

o 

o 

o 

o 

15.  Do  you  feel  that  the  ER  community  is  being  appropriately  utilized  by  your  unit  as 
a  data  source? 
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16.  Community  Oriented  Policing  is  often  cited  as  a  source  of  potential  information 
for  law  enforcement  in  the  Homeland  Security  effort. 

None  Less  than  5%  5-10%  10-25%  25-50%  Over  50% 

Community  Oriented 
Policing  provides  the 
following  amount  of  our 
tips  and  leads. 

17.  Is  Community  Oriented  Policing  under  utilized  as  an  information  source? 

8; 


I  Yes 
I  NO 


If  yes,  how  can  that  be  improved? 


18.  Do  you  feel  it  is  important  to  acknowledge  members  of  the  ER  community  that 
provide  information,  a  tip  or  a  lead. 


Does  your  unit  acknowledge  those 
that  provide  information? 


Does  your  unit 
acknowledge  emergency 
responders  that  provide 
information? 


If  yes,  how? 

i — a 


If  yes,  how? 

I - B 


19.  Can  you,  or  your  analysts,  "task"  the  ER  community  with  a  request  for  additional 
information  on  case  being  worked? 


0 


Yes 

No 


If  yes,  how? 

I 


20.  Does  your  unit  have  a  liaison  officer  with  (check  all  that  apply): 

Y/N?  Role  Role  Role 


Law  Enforcement 
Fire 

Emergency  Medical 
Services 

Public  Health 

Public  Works 

Other 

Other  (please  specify) 


r~ 

i 

▼  | 

i 

▼  1 

1 _ Id 

r~ 

▼  i 

i 

~ i-i 

21.  If  you  have  a  Terrorism  Liaison  Officer  (or  similar)  program  what  are  the 
beneifts? 


3 
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22.  If  you  have  a  Terrorism  Liaison  Officer  (or  similar)  program,  how  would  you 
improve  it  if  you  were  able  to  make  the  changes? 

zi 

23.  Is  your  unit  only  concerned  with  terrorist  activity? 

PYes 
□  No 


24.  If  your  unit  produces  analysis  on  crimes  other  than  terrorist  threats: 


Narcotics 

Money 

Laundering 

Counterfeiting 
(other  than 
money) 

Financial 

Crimes 

Crimes  of 

Violences 

Gangs 

Other 

What  crimes  are  analyzed?  j 

□ 

□ 

□ 

□ 

□ 

□ 

Other  (please  specify) 

25.  If  your  unit  conducts  "other  than  terrorist  analysis"  how  is  the  decision  made  on 
what  gets  analyzed? 

Policy 

Unit  director/commander 

Immediate  supervisor 

Investigator 

Analyst 

Other 

Other  (please  specify) 

26.  Who  can  "task”  your  unit  and  how? 

I  1 


27.  If  you  are  currently  a  terrorist  and  "other  crimes"  analysis  unit,  how  would  it 
affect  your  unit  if  it  were  required  to  focus  exclusively  on  anti-terrorist  activity? 


Never 

Seldom 

Sometimes 

Often 

Usually 

Almost  always 

Always 

Useable  intelligence 
product  would  be  reduced 

o 

o 

o 

o 

o 

o 

o 

"Value"  to  consumer/end 
users  would  be  reduced 

o 

o 

o 

o 

o 

o 

o 

Analysts'  skills  would  suffer 
from  lack  of  applicable 
"real  life"  work 

o 

o 

o 

o 

o 

o 

o 

Support  from  parent 
agencies  would  be  reduced 

Other  (please  specify) 

o 

o 

o 

o 

o 

o 

o 
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28.  Some  people  believe  that  Fusion  Centers  should  focus  on  anti-terrorist  analysis 
exclusively. 

Is  there  enough  terrorist  activity  in  your  area  of  responsibility  to  support  an 
exclusively  terrorist  work  load? 

d 

zl 

29.  The  individual  responses  to  this  survey  will  remain  anonymous  unless  you  indicate 
that  your  responses  can  be  attributed  to  your  fusion  center.  Do  you  want  your 
responses  kept  confidential? 

Q- 
O No 

Optional:  Name  and  position 
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